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1. Introduction 



Entanglement is a unique phenomenon of quantum mechanics that has puzzled 
generations of physicist. While initially the discussion was mainly driven by conceptual 
and philosophical considerations, e.g. regarding hidden variable theories, in recent 
years the focus has shifted to practical aspects and applications. It was realized 
that entanglement constitutes a valuable resource that can be used for various tasks 
in quantum information processing, many of which have in the meantime been 
experimentally demonstrated with a number of systems including nuclear magnetic 
resonance, photons, light beams, ions, neutral atoms, atomic ensembles, cavity QED, 
Josephson junctions and quantum dots. The remarkable experimental progress is 
even exceeded by the vast theoretical achievements that have lead to a new theory 
of quantum information, with quantum cryptography and quantum computation as 
most prominent offsprings. 

In this context, the generation and maintenance of high-fidelity entanglement 
is a central problem. In the last decade, the controlled manipulation of certain 
systems in such a way that entangled states can be produced on demand has become 
possible. However, noise in such control operations as well as interactions with 
an uncontrollable environment have the effect that the desired entangled states are 
produced only with a certain non-unit fidelity. Similarly, entangled states that are 
ground states of certain (strongly coupled) systems are not obtainable in the lab due 
to thermal fluctuations that lead to a thermal (mixed) state with non-unit fidelity for 
any non-zero temperature. Several ways to protect quantum information in general 
and entangled quantum states in particular have been designed in recent years. These 
methods include quantum error correction, where quantum information is protected 
by using a certain encoding, quantum error avoiding schemes as well as entanglement 
purification. The latter is the main subject of this review article. 

In entanglement purification [H El E], several copies of noisy, non-maximally 
entangled states are manipulated in such a way that a fewer number of copies with 
a reduced amount of noise are produced. The entanglement of the total ensemble 
is concentrated or distilled in a few copies, which hence contain a larger amount of 
entanglement and have higher fidelity with respect to a maximally entangled states. 
We will use the term entanglement distillation to refer to the manipulation of an 
ensemble of states in such a way that (a reduced number of) maximally entangled 
states are distilled. Entanglement distillation uses entanglement purification as a 
building block to increase the information about the ensemble, and hence to achieve 
this aim. The purified states can then eventually be used for various entanglement- 
based applications, ranging from quantum teleportation to quantum computation. 
It is worth pointing out that entanglement purification has been experimentally 
demonstrated for single photons [H El [6l [71 [8] , and very recently also for atoms [9] . 
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Entanglement purification was originally introduced in the context of quantum 
communication as a solution to the problem of communication over noisy quantum 
channels [Tl[51[3]. We will discuss this aspect of entanglement purification in Sec. [U 
where we also briefly review quantum error correction as an alternative solution. Sec. 
[3] includes an overview and a detailed description of known bipartite entanglement 
purification protocols, while Sec. [4] establishes the close connection between quantum 
error correction and entanglement purification. The influence of noise in (local) control 
operations is discussed in Sec. El while Sec. [6] illustrates a number of applications of 
entanglement purification protocols, including long distance quantum communication 
and quantum computation. We then move to multipartite systems, where we describe 
multipartite entanglement purification protocols and the role of noise in these protocols 
in Sec. [7l and illustrate possible apphcations in Sec. [H We provide an outlook on 
future perspectives of entanglement purification, including a number of relevant open 
problems, in Sec. [51 

We remark that in this review article we only touch upon the (extensive) subject 
of quantum error correction. For a more comprehensive treatment of quantum 
error correction we refer the reader for example to Refs. [101 El IE] (see also 
|2l[13l[l4l[l5l[l6l[lll[18l[19l[20l[2l])- We concentrate on theoretical aspects of 
entanglement purification and its applications, where our main focus lies on the work 
which has been carried out by our group in the last couple of years. 

2. Quantum communication via noisy channels 

Quantum cryptography is the most advanced application of quantum information 
processing, where even first commercial systems can be purchased and are probably 
already used in practice. The transmission of quantum information over noisy channels 
in such a way that their quantum nature is sufficiently preserved is the central problem 
in this context. As quantum information is unavoidably affected by noise, ways to 
protect it need to be designed in order to ensure (almost) error free, i.e. noiseless, 
exchange of quantum information. 

Even though quantum information cannot be cloned perfectly or amplified 
without changing their quantum nature, different techniques are known to protect 
quantum information from noise. The two solutions to the problem are provided by 

(i) quantum error correction 

(ii) teleportation in combination with entanglement purification. 

In (i), quantum information is encoded in a larger dimensional Hilbert space and 
in this way protected from noise. In the second approach (ii), the problem of 
transmitting unknown quantum information over a noisy channel is replaced by the 
task of distributing a known entangled state with sufficiently high fidelity, which can 
then be used, by means of teleportation, to transmit arbitrary quantum information. 
Entanglement purification is thereby the tool to obtain (known) high-fidelity entangled 
pairs. 

We first specify the set-up we have in mind. We consider two spatially separated 
parties A (Alice) and B (Bob) who wish to communicate with each other, i.e. transmit 
quantum information. They are connected via a possibly noisy quantum channel 
described by a completely positive map £, and in addition by a classical channel 
which either only allows for classical communication from A ^ B (one way classical 
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communication), or for classical communication between A B and B ~* A (two- 
way classical communication). In addition, we assume that Alice and Bob can locally 
manipulate their quantum states and have access and control of auxiliary systems. 
This set of local operations and classical communication is denoted by LOCC. For 
qubits, a general quantum channel £ can be written as 

3 

= X! Pk,i<^kpo-i, (1) 
fe,;=o 

where aj denote Pauli operators with cfq = 1, (Ti = <7x,cr2 = ctj, , = (Tz- Often, we 
will consider Pauli-diagonal channels S-p which are of the form 

3 

S-PP = ^Pk<^kpa-k- (2) 

k=Q 

Notice that any quantum channel £ can be brought to Pauli-diagonal form by 
means of depolarization (see Ref. [H]) in such a way that the diagonal elements 
are not altered, pk = Pk,k- This often allows one to restrict considerations to 
Pauli-diagonal channels, and makes such channels particularly important. A special 
instance of a Pauli-diagonal channel is the depolarizing (or white noise) channel, where 
Pi = P2 = P3 = (1 — Po)/3, which is described by a single parameter p = po- 

We will discuss the basic principles of quantum error correction and entanglement 
purification in the following. 



2.1. Quantum error correction 

In standard quantum error correction (QEC) (see e.g. Refs. [IOl[TTl[T^ for reviews, 
and also [2lll3lll4l|15lll6llI3ll8l[l9l[20l[21]), quantum information is protected 
by encoding one logical qubit of quantum information into several physical qubits, 
or more generally k logical qubits into n physical qubits. The basic idea of such a 
redundant encoding is borrowed from classical coding and error correction, although 
additional requirements have to be met for quantum error correction, e.g. the 
preservation of arbitrary superposition states. In the simplest case where one qubit 
is encoded into n qubits, we define logical qubits \0l), as two orthogonal states 
IV'o) = |0l), — G C^". Any (unknown) qubit in a state a|0) + /?|1) is encoded 
via a unitary encoding operation Ue & SU{2^) yielding an encoded state 

(a|0) + m) ® |0)^"-^ -> {a\QL) + /3|1l)). (3) 

The choice of \ipo), is crucial for the error correcting properties of the code. The 
basic idea is to use states {ipo), where the two-dimensional subspace S spanned by 
{IV'o); IV'i)} is mapped to orthogonal two-dimensional subspaces by error operators. 
By measuring appropriate two-dimensional projectors, one can distinguish between 
these subspaces. Importantly, coherent superpositions within each of the subspaces 
are not altered and hence quantum information is preserved. Notice that these 
measurements also discretize errors, i.e. an independent treatment of error operators 
is justified. Consider as an example a n-qubit code that is capable of correction an 
arbitrary single qubit error, specified by a single-qubit Pauli error al°'\ acting on 
one of the n qubits. If the action of any of these Pauli operators a^""^ is such that the 
two-dimensional subspace 5* is transformed to a subspace Si^a, and all these subspaces 
are pairwise orthogonal, then the corresponding code is capable of correcting for all 
such errors. The minimum number n of qubits for which this is possible is given by 
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5, as there are 3n different error operators, and the possible number of orthogonal 
two-dimensional subspaces is given by 2""^. In fact, error correction codes that can 
protect a single qubit from an arbitrary single qubit error using only 5 qubits are 
known [5J I18j . In a similar way, one can construct quantum error correcting codes 
where k logical qubits are encoded into n physical qubits, and where a total of m errors 
can be corrected. The basic idea of such a construction is still that each correctable 
error operator should map the relevant information carrying subspace S of dimension 
2*^ to an orthogonal subspace 5*^ , and all these subspaces are pairwise orthogonal and 
hence distinguishable. In this way the type of error can be detected and corrected 
by determining the correspond j via 2'^-dimensional projective measurements. In 
addition, quantum information stored in coherent superpositions of states within the 
subspace S remain unaltered. 

Codes can also be designed to only detect errors. For error detection, it is 
only required that an error operator Oj maps states within the subspace S to the 
orthogonal subspace S-^, however it is no longer necessary that different error operators 
map all states within the subspace S to pairwise orthogonal subspaces Sj. This 
implies that different error operators can lead to the same output state, and hence 
are indistinguishable. Nevertheless, the occurrence of an error can still be determined. 
Notice that the possibility to detect certain kinds of e.g. multi-qubit errors in addition 
to the possibility to distinguish between any kind of single-qubit errors is often an 
additional feature of error correcting codes. Error correcting codes can also be applied 
in a concatenated fashion, that is an encoded qubit is once more encoded on a next 
level using now encoded qubits q;|Ol) + /9|1l) of level one as basic elements. Such 
concatenated error correction codes lie at the heart of a fault-tolerant implementation 
of quantum computation, but are also discussed in the context of long-range quantum 
communication using QEC [24] . 

A general class of quantum error correcting codes of particular importance are the 
Calderbank-Shor-Steane (CSS) codes [161 IE] where encoding and decoding circuits 
consist of Clifford operations only [12] . We will mainly consider such codes here. These 
codes belong to the class of stabilizer codes, which allows for a simplified description 
and error analysis. We also mention that recently the concept of operator quantum 
error correction [21] , as well as topological protection of quantum information [23] 
have been introduced. 

2.1.1. Long-distance quantum communication using QEC For long-range quantum 
communication, one protects an (unknown) qubit by encoding it with a concatenated 
quantum error correcting code ,24J. The encoded quantum information is then sent 
through a noisy channel over a short distance, where the distance is chosen such that 
the probability for an error on the logical qubit is sufficiently small. More precisely, 
the error probability must be below a certain threshold such that error correction is 
still possible. Then an error correction step is performed, which involves decoding and 
measurements or direct error syndrome extraction, as well as correction. The signal is 
again encoded and sent further through a small segment of the channel. Concatenation 
of the error correction code ensures that errors on physical qubits below a certain 
threshold become exponentially suppressed at higher concatenation levels. This yields 
to a perfect transmission of quantum information with only polynomial overhead in 
additional qubits. To guarantee a fault-tolerant transmission, errors in coding and 
decoding operations at the error correction stations need to be taken into account. 
Although this is possible, one obtains a rather stringent error threshold of the order of 
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10 * for local control operations, and also a small amount of tolerable channel noise 
at the order of percent [21], significantly restricting the length of the segments. 

2.1.2. Channel capacities and capacities of QEC codes The capacity of a quantum 
error correcting code (QECC) is defined as the maximum asymptotic rate of reliable 
transmission of unknown quantum information through a noisy quantum channel, 
using the QECC to encode the states before transmission and decode them afterwards. 
More precisely, we consider a quantum channel £ which is described by a completely 
positive trace preserving linear map £ from the input Hilbert space Tic to the output 
Hilbert space Tio- A quantum error correcting code is associated to coding (C) and 
decoding (T>) operations. The coding operation C maps an input state \(f>) e Tiin to an 
encoded state of n systems in Hilbert space Tif"", which are then transmitted through 
a noisy quantum channel f*" and decoded afterwards. These coding and decoding 
operations define a (n, e) code if one achieves transmission with fidelity larger than 
1 — e for all possible system states, 

min|^)eW.„('/>|25°^®"°C(|0)((/.|)|0) > 1-e. (4) 

The rate R = logdimTiin/n of a specific code is called achievable if for all e, i5 > and 
sufficiently large n one obtains a rate R—S. The quantum capacity Q{£) of a bipartite 
quantum channel £ is defined as the supremum of all achievable rates R over all codes 
(see Ref. [25] for a rigorous definition). Coding and decoding operations may be 
assisted by forward classical communication or two-way classical communication 
(<->) which gives rise to quantum channel capacities [Q^] respectively. We will 
mainly consider Q = here. We remark that a minimal pure state fidelity F — 1 — e 
for all 10) e Hin implies an entanglement fidelity Fe > 1 — 3e/2 for all density operators 
p whose support lies entirely in that subspace [25] . That is, when transmitting part 
of an entangled state |<1>) which is a purification of p, the resulting state has fidelity 
F > 1 - 3e/2 with respect to |$). 

2.2. Quantum communication via noisy entanglement purification and teleportation 

An alternative to direct transmission of quantum information over a (noisy) channel is 
provided by noisy entanglement purification followed by teleportation. More precisely, 
as shown in Ref. [26 , a maximally entangled pair 

\c^+)^^{\0)a\0)b + \1)a\1)b) (5) 

shared between A and B can be used as a resource to transmit one qubit of information 
from Alice to Bob, using only local resources and classical communication of two 
classical bits. In this sense, a maximally entangled pair serves as a perfect quantum 
channel. Hence the problem of transmitting unknown quantum information is shifted 
to the problem of generating a maximally entangled state. 

We start by briefly reviewing the teleportation protocol , while entanglement 
purification is treated in more detail below. The teleportation protocol consists of the 
following steps: 

(i) Alice performs a local Bell measurement in the basis {10^)^'^} with \(j)j) — 
l(g)CTj|(/)+) on qubit A! to be teleported and qubit A of the maximally entangled 
state; 
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(ii) Bob performs a correction operation aj on qubit B depending on the outcome j 
of the measurement. 

Step (ii) involves classical communication from Alice to Bob. Please note that in this 
way not only the local quantum information stored in the qubit A' is transferred 
to B, but the qubit B takes over completely the role of qubit A' , in particular 
also its entanglement with additional particles. The latter property can be used for 
entanglement swapping [571 UHl [Ml [SO], where entanglement between systems ACi 
and C2B leads to an entangled state between systems AB by teleporting Ci to B. 
Teleportation has been experimentally demonstrated for single photons [311 [32l [33] , 
light beams [31] and atoms [351 [3S] , and very recently also to for the transmission of 
quantum information between different media, namely from light to matter [37^ . 

For quantum communication over noisy channels, teleportation alone is not 
sufficient. When sending one qubit of a maximally entangled pair through a noisy 
channel, one ends up with a noisy, non-maximally entangled state. Although such a 
noisy state can still be used for quantum teleportation, the fidelity of the teleported 
qubit is reduced. However, one can in principle produce many copies of the noisy 
entangled pairs and purify these pairs using entanglement purification, i.e. increase 
the entanglement of a few copies. This is possible since the desired state is known, in 
contrast to the general situation in direct quantum communication where the states 
may be unknown. 

Entanglement purification is a fundamental tool in quantum information 
processing. We will concentrate in this section on its application in quantum 
communication, where entanglement purification together with teleportation provides 
a scheme for error-free quantum communication over noisy channels. The basic 
idea is to create several copies of noisy entangled states, e.g. by sending parts of 
locally created entangled pairs through noisy quantum channels. These states are 
then processed locally, more precisely a sequence of local operations (assisted by one 
or two-way classical communication) is applied in such a way that a reduced number 
of pairs with an increased fidelity is generated. Iteration of such protocols eventually 
leads to maximally entangled states. The entanglement is purified at the cost of 
obtaining a smaller number of copies. This can be done in a systematic way, and 
several entanglement purification protocols are known which can achieve this task. 
The purification protocols can be grouped into distillation protocols, and recurrence 
and pumping schemes. In distillation protocols, an ensemble of many (identical) copies 
is manipulated and a few pairs with improved fidelity are generated. In recurrence 
and pumping schemes, a certain elementary purification step is repeated several 
times, resulting in pairs with improved fidelity. We will discuss such entanglement 
purification protocols in the following section in more detail. 

2.2.1. One-way and two-way classical communication The protocols differ in the 
number of initial and final copies of the states, and the allowed additional resources, 
most importantly one-way or two-way classical communication. 

A protocol may operate on TV copies of noisy entangled states and produce M < N 
purified copies as output. In case of one-way classical communication, one measures 
N — M copies and uses the obtained information to choose a proper correction 
operation on the remaining pairs. Notice that for the choice of these correction 
operations, Alice only has access to the local measurement outcomes in A, while Bob 
has access to outcomes of measurements in A and B. In particular, this implies that the 
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parties cannot decide to discard certain pairs based on joint measurement outcomes, 
as it is used in several entanglement purification protocols. To make this possible, 
one needs two-way classical communication. Protocols based on one-way classical 
communication turn out to be equivalent to quantum error correction [5] in a sense 
we will specify below, and one may say that entanglement purification runs in error 
correction mode. On the other hand, protocols with two-way classical communication 
make use of additional resources and are provably superior to quantum error correction 
and one-way entanglement purification j2l [38] . Such two-way protocols can also run 
in an error detection mode. 



2.2.2. Purification range and yield of a protocol The yield of a protocol with respect 
to a certain state is a central quantity that determines how efficient a protocol 
is. Consider N copies of a mixed state, p^^ , which are processed by a certain 
entanglement purification protocol V that may be applied in an recursive way. After 
this procedure, M (exact) copies of a maximally entangled state are obtained. The 
yield of the protocol V with respect to the state p is defined as 

M 

Yp.v = ^, (6) 

i.e. the ratio of number of maximally entangled states obtained by the protocol over 
the total number of initial copies of the state p, where often the limit iV ^ cxi is 
considered. More precisely, one considers an entanglement purification protocol and 
the corresponding LOCC transformation p*^^ Tn, where we are interested only 
in the reduced density operator of M copies, rj\/ = tTM-i,...N^N- We demand 
that for all e > 0, the fidelity of Ti\i with respect to M copies of a maximally 
entangled state |$) = \(f>+)'^'^^ should be larger than I - e, F = {<^\Tm\'^) > 1 - e. 
The yield is then determined by the ratio M/N of the maximum M for which 
this is the case, in the asymptotic limit of — > oo. The maximum of the yield 
over all protocols (or equivalently all sequences of local operations and classical 
communications (LOCC)) is also called the distillable entanglement Dp, and again 
one may consider these quantities with respect to one way or two-way classical 
communication, Y~^,Y^, D'^ , D'j^ . The distillability problem, i.e. the question 
whether there exists a LOCC protocol that can generate maximally entangled states 
from (infinitely) many copies of a state, has been extensively studied in recent years, 
however a complete solution has not been obtained so far. What is, however, known 
are necessary conditions for distillability (e.g. that the partial transposition of the 
density operator is non-positive |39j). as well as sufficient criteria. In particular, any 
entanglement purification protocol provides a sufficient criterion for distillability. 

We remark that such a strict definition of yield actually implies that many 
entanglement purification protocols have zero yield, although they can produce 
entangled states with arbitrary high fidelity. We will consider later a modified 
definition of the yield, where the condition of arbitrary accuracy for the produced 
states is dropped and replaced by a condition for a certain fixed fidelity F — 
1 — Cq. Notice that whenever one considers noise in local control operation, perfect 
entanglement purification is impossible, i.e. no entanglement purification protocol is 
capable of producing perfect maximally entangled states with fidelity F — I. 

The purification range (or basin) of a protocol is defined as the set of all input 
states p that can be purified by the protocol, i.e. where maximally entangled states 
can be generated from N copies of p in the limit of N oo. Often, certain families 
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of density operators specified by a single or a few parameters are considered. An 
example of such a family are the so-called Werner states (see Eq. (fTB|) below) which 
are mixtures of a maximally entangled state and a completely mixed state. In this 
case, the purification range can be obtained analytically, yielding a simple condition 
that can be expressed in terms of the fidelity of the state. In general a complete 
characterization of the purification basin for a given protocol is very complicated. 
However, bounds on the purification range can be established which are based on 
either necessary conditions for distillation, or on sufficient conditions for entanglement 
purification using a specific protocol (e.g. that the fidelity with respect to a maximally 
entangled state be above a certain threshold value). 

3. Basic bipartite entanglement purification protocols 

We now turn to explicit entanglement purification protocols. A number of different 
protocols exist, which differ in their purification basin (i.e. the set of states they 
can purify), the efficiency, and the number of copies of the states they operate on. 
In the following we will consider filtering protocols (which operate on a single copy), 
recurrence protocols (which operate on two copies simultaneously at each step) as well 
as hashing and breeding protocols (which operate simultaneously on a large number 
TV ^ cxD of copies). We also discuss (intermediate) iV — > A/ protocols, which operate 
on N input copies and produce M output copies. The latter protocols can also be run 
in a recursive way. 

3.1. Filtering protocol 

The simplest protocols operate on a single copy of the mixed state p and consist in 
the application of local filtering measurements (including weak measurements). A 
weak measurement may e.g. be realized by a joint, local operation on the system and 
a (possibly high dimensional) ancilla, followed by a von Neumann measurement of 
the ancilla. Hence sequences of local operations, including weak measurements, are 
applied in such a way that for specific measurement outcomes the resulting state a is 
more entangled than the initial state p. Note that the output state cr is obtained only 
with a probability p < 1. Mixed states where such a filtering method can be applied 
include certain rank two states of the form [40] 



where |'I'+) = 1/V2(|01) + |10)). Application of the local operators Oa = Ob = 
i/e|0)(0| + |1)(1| (which correspond to a specific branch of a local positive operator 
valued measure, POVM) lead to a non-normalized state of the form 



entangled state l^*^) can be created. However, the probability to obtain the desired 
outcome, psuc — Fe + {1~ F)e^, goes to zero as e ^ 0. There is a tradeoff between the 
reachable fidelity of the output state and the probability of success of the procedure. 
The optimal filtering protocol for any mixed state of two qubits has been derived in 
[41], and experimentally demonstrated in [42] . 



p = ^|*+)(^'+| + (1 - F)|00) (00|, 



(7) 
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Figure 1. Schematic representation of the bipartite entanglement purification. 



It turns out that filtering protocols are of limited applicability for general mixed 
states, even for the simplest case of two qubits. In particular, as shown in Refs. 
[151 03] , the fidelity of a single copy of a full rank state can in general not be increase 
by any local operation. This seriously restricts the applicability of filtering procedures 
and requires us to consider protocols on two (or more) copies of the state in order to 
increase the fidelity for a general class of mixed input states, and ultimately to obtain 
maximally entangled states. 

3.2. Recurrence protocols 

In the following we discuss a class of conceptually related protocols [1] [2l [3l |45] that 
allow one to produce states arbitrarily close to a maximally entangled pure state by 
iterative application. Before we go into technical details, we describe the general 
concept underlying these (and almost all) entanglement purification protocols. The 
idea of entanglement purification protocols is to decrease the degree of mixed-ness 
of the ensemble of mixed states. To this aim, one needs to gain information, which 
is done by performing suitable measurements. As the relevant information is not 
locally accessible, one needs to use the entanglement inherent in states of the ensemble 
to reveal this information. In fact, information about a particular sub-ensemble 
is obtained by first operating jointly (but still locally) on several states and then 
measuring one of these states. In many protocols the remaining states are only kept if 
a specific measurement outcome was found. This is due to the fact that one finds for 
certain measurement outcomes (measurement branches) that the entanglement of the 
remaining states is increased, while for other outcomes it is decreased or the states 
are even no longer entangled. In this way it is also guaranteed that, on average, 
entanglement can not increase under local operations and classical communication. 

Recurrence protocols operate in each purification step on a fixed number of copies 
of a mixed state. We will mainly consider recurrence protocols that operate on 
two identical copies here, but also treat briefiy the cases where the copies are not 
identical (e.g. in pumping schemes) or more than two copies are involved. After local 
manipulation, one of the copies is measured, and depending on the outcome of the 
measurement the other copy is kept (we refer to this as a successful purification step) 
or discarded (see Fig. [1]). In case of a successful purification step, the fidelity of the 
remaining pair is increased. The procedure is iterated, whereby states resulting from a 
successful purification round are used as input for the next purification round (see Fig. 

. Typically, these protocols converge to a fixed point which is given by a maximally 
entangled state. 



CO 



12 




Figure 2. Schematic representation of a recurrence protocol. States form a 
successful purification round serve as inputs for the next purification round. 



3.2.1. Basic properties and notation We now turn to specific recurrence protocols 
that allow one to purify bipartite entangled states of two qubits. We will not describe 
these protocols as they were originally presented, but provide an equivalent description 
which will allow us a unified treatment of bipartite and multipartite entanglement 
purification protocols. In particular, we describe protocols that operate on states 
in a (locally) rotated basis and describe the corresponding states in terms of their 
stabilizing operators. To this aim, we start by fixing some notation. We consider two 
parties, A and J3, each holding several copies of noisy entangled states described by a 
density operator pab acting on Hilbert space ® . We denote by 

|<f>oo)^-^(|0),|0>.) + |l),|l).), (10) 

a maximally entangled state of two qubits, where 10)2,11)^ [|0)a;, ll)^;] are eigenstates 
of [ox] with eigenvalue (±1) respectively. For example, (Tajll)^; — — and 
|0)^ = 1/V2(|0), + |1)^). We also define 

|<i>,,,,)EEa^aM<i>oo), (11) 

with ki,k2 e {0,1}. The states {|<&fcifc2)} form a basis of orthogonal, maximally 
entangled states, the so called Bell basis. We remark that the states \^kik2) a-i'e joint 
eigenstates of correlation operators 

K,^a^^^af\ K,^ai^^a^i^\ (12) 

with eigenvalues (— 1)*^^ and (—1)*^^ respectively. Whenever several copies of a mixed 
state are involved, we will refer to the different copies by numbers. For instance, paiBi 
refers to the first copy of a state, while PA2B2 refers to the second copy. In this case, 
party A holds two qubits, Ai and A2. 
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We consider mixed states which we expand in the Bell basis, 
1 

p'ab= E K,k,nn\'^k,k,)(^nrA- (13) 

ki,k2,ji,j2=0 

This state can e.g. be created by sending the second qubit of a maximally entangled 
state through a noisy quantum channel Eq. One can always depolarize the 

state to a standard form by a suitable sequence of (random) local operations in such 
a way that the fidelity of the state, 

F = {^qo\pab\^oo) (14) 

is not altered. To be specific, by probabilistically applying one of the multi-local 
operations corresponding to {1, Ki, K2, K1K2} one produces a density operator which 
is diagonal in the Bell basis, 

1 

PAB = E ^fclfe2l*fclfe2)(*felfe2l> (15) 

ki,k2=0 

and in which diagonal coefficients remain unchanged, \k1k2 = ^'kik2kik2- This 
dephasing step can be understood as follows: Consider for instance the action of 
Ki on basis states l^fcifea)- For fci = 0, the state is left invariant while a global 
phase of (—1) is picked up if ki = 1. It follows that off-diagonal elements of the 

form |<l'fei/c2)(*i'jij2l (ESI) are transformed to (-l)''^®^H*J'feife2) ('l'ju2 L i-^- acquire 
a phase if fci 7^ ji. Consequently, when applying the local operation Ki with 
probability p — 1/2 and leaving the state unchanged otherwise, the resulting density 
operator p' ~ \/2{KipK\ + p) has no off-diagonal elements where fci 7^ ji. In a 
similar way, all off-diagonal elements are cancelled by the (random) application of 
t,Ki,K2TKiK2- Note that all diagonal elements -in particular the fidelity of the 
state- remain unchanged by this depolarization procedure. Using similar techniques, 
one can further depolarize the state by making all but one of the diagonal elements 
equal. The resulting states are called Werner states [32] , 

pw{x) = x|$oo)($oo| + (1 - (16) 

where the fidelity F = (3x + l)/4 is unchanged. This can be accomplished by 
randomly applying local unitary operations that leave the state |$oo) (up to a phase) 
invariant, which is the case for all operations of the form U ® HU* H with H being the 
Hadamard gate and * denoting complex conjugation. The unitaries can be chosen 
uniformly (according to the Haar measure), or selected from a specific finite set of 
operations [HI!]- Notice, however, that the entanglement of the states may decrease 
by the depolarization procedure, even though the fidelity remains unchanged. What 
is important in our context is that any state with fidelity F can always be brought 
to Werner form. It is thus sufficient to provide an entanglement purification method 
which works for Werner states, because such a method automatically allows one to 
purify all states which have the same fidelity, independent of their "shape". We 
consider such a purification procedure in the following. 

X The Hadamard operation H maps basis state of z basis to basis states of x basis and vice versa, 
i.e. H\k):, = \k)x,H\k)a: = \k)z with fc = 0, 1. 
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3.2.2. BBPSSW protocol In 1996, Bennett et al. [T] introduced a purification 
protocol that allows one to create maximally entangled states with arbitrary accuracy 
starting from several copies of a mixed state p, provided that the fidelity F with some 
maximally entangled state fulfills F > 1/2. The protocol consists of the following 
steps: 

(i) Depolarize p to Werner form; 

(ii) apply bilateral local CNOT operations f/cNOT ' ® ^cnot ' S 

(iii) measure qubit A2 [-B2] locally in eigenbasis of cr^ [uj.] with corresponding results 
(-1)^1 [(-1)^1] respectively, where £ {0,1}. The effect of this local 
measurement on other particles is the same as the measurement of the observable 

^(^2S2). 

1\2 1 

(iv) keep state of the pair AiBi if (Ci + ^i)mod2 = 0, i.e. measurement results 
coincide. 

Given two copies of a state with fidelity F, it is straightforward to calculate the fidelity 
of the resulting state when applying (i-iv) . The effect of (ii) on two Bell states is given 

by 

\^kuk2) MbA^]u]2) A2B2 \^ki®juk2)AiBA^]uk2S)j2)A2B2- (17) 

The effect of (iii) and (iv) is to select states in A2B2 which are eigenstates of iC^^^^ 
with eigenvalue (+1), while eigenstates with eigenvalue (-1) are discarded. That is, 
only initial states |<&fci,fc2)AiBi I'fji ^2)^252 with fc2® ^2 = will pass the measurement 
procedure, which implies that, when considering mixed states, only these components 
will contribute to the final density operator. The final state turns out to be not 
of Werner form, however due to step (i) the state is brought back to Werner form 
when iterating the procedure. Hence the essential parameter is the fidelity F' after a 
successful purification step. One finds 

r.> f^ + [(l-F)/3p 

F2 + 2F(l-^^)/3 + 5[(l-^^)/3]2' ^ ' 

which fulfills F' > F for F > 1/2. The success probability is given by the denominator 
ofEq. (IT8l),psuc = F2 + 2F(1-F)/3 + 5[(1-F)/3]2. Iteration of the procedure, which 
means to take two identical copies of states with fidelity F', resulting from a previous, 
successful purification round, allows one to successively increase the fidelity. In fact, it 
is straightforward to see that the map Eq. (fT8| has F = 1 as an attractive fixed point. 
Hence states arbitrarily close to maximally entangled states can be produced. Even 
though the probability of success of the purification steps tends to one for F ^ 1, the 
yield of the procedure goes to zero as one of the pairs is always measured and has to be 
discarded. Fixing however the desired target fidelity of resulting states to F > 1 — eo, 
a finite number of purification steps suffices and hence the yield will be finite. We 
remark that the obtainability of states with F = 1 seems to be a question of only 
theoretical relevance, since imperfections in the apparatus used for the preparation of 
the state and in the purification procedure limit the reachable fidelity. 



3.2.3. DEJMPS protocol The DEJMPS protocol, introduced by Deutsch et al. in 
Ref. [3], is conceptually similar to the BBPSSW protocol. It operates however not on 
Werner states, but on states diagonal in a Bell basis (see Eq. [T5|) . The main advantage 

§ The CNOT operation is defined by \i) A\j) B — * ©i)s> where © denotes addition modulo 2. 
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of this protocol is that it has higher ef&ciency. The protocol operates on two identical 
copies of a state and consists essentially of the same steps as the BBPSSW protocol. 
The only difference is that step (i) is replaced by a step (i'). 

(i') perform local basis change 

|0)i^' - ^(|0)(^) - ^|1)(^)), |l)i^) - i=(|l)i^) - z|0)(^)) 

|o)i^) ^ -L(|o)(^) + ^|i)(^)), |i)(^) ^ _L(|i)(B) + ,|o)(B)). 

The effect of step (i') is (up to some irrelevant phases) to flip the diagonal components 
of |$io) and |$ii), i.e. Aio <~* An. One may in addition add a depolarization of p to 
Bell-diagonal form (see Eq. [T5)) . however as shown in Ref. [3] the off-diagonal terms 
do not influence the protocol anyway. The total effect of the protocol (steps (i-iv)) 
can be described as a non-linear map for the diagonal components of p to p' (written 
in the Bell basis), i.e. a map from M'* ^ R^. To be specific, the map reads [3] 

Aoo = (A^o + A?i)/A^, = {Xl^ + Xlo)/N, 

A'lo = 2AooAn/A^, A'^ = 2AoiAio/A^, (19) 

where N — (Aqo + An)^ + (Aqi + Aio)^ is the probability of success of the protocol. 
Again, the protocol can be iterated, and the diagonal coefficients of the state in the 
Bell basis after k successful purification steps can be calculated by k iterations of the 
map Eq. p^. One can show that the map has Aqo = 1, A^j = for ij ^ 00 as 
attracting fixed point, and in fact all states with Aqo > 1/2 (i.e. F > 1/2) can be 
purified gT]. 

3.2.4. Entanglement pumping While both the BBPSSW and DEJMPS protocol 
allow one to successfully produce entangled states with arbitrary high fidelity, the 
requirements on local resources are rather demanding. Since at every round two 
identical states resulting from previous successful purification rounds are required, 
the total number of pairs that have to be available initially increases exponentially 
with the number of steps. In real implementations these pairs have to be stored by 
some means. For many physical set-ups, however, the number of particles that can 
be stored is limited. 

The requirements in memory space can however be translated into temporal 
resources. The corresponding purification protocol is called (nested) entanglement 
pumping [351 UHl SS] (see also Fig. [3]). The basic idea is to repeatedly produce 
elementary entangled pairs (resulting e.g. from the transmission of these maximally 
entangled state through noisy channels) and using a fresh elementary pair to purify 
a second pair. If a purification step is not successful, one has to start again from 
the beginning, using two elementary pairs. The actual sequence of local operations 
is either given by the BBPSSW or DEJMPS protocol, where the pair to be purified 
acts as pair 1 (source pair), while the fresh, elementary pair plays the role of pair 2 
(target pair) that is measured. In case the purification step was successful, the fidelity 
of the first pair is increased by a certain amount. It is straightforward to determine 
the maps corresponding to Eqs. (|18|19p for non-identical input states. One finds 

F' = ^1^^ + (^) (^) .20) 

F^F, + F,C-^) + {^)F,+5C-^){^-^y ^ ^ 
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in the case of two Werner states with fidehty Fi,F2. In this map, F2 is to be considered 
as constant since the second pair is always an elementary one. For two Bell diagonal 
states with coefficients A^^ and we obtain 

^00 = (AooMoo + Aii/^ii)/iV, = (AoiMoi + Xw^J.io)/N, 

A'lo = (AooMii + XiiHoo)/N, \[^ = (Aoi/^io + Xw^j.oi)/N, (21) 

Again, the second pair is always an elementary one, and hence ^ik is fixed. While 
iteration of the corresponding maps allows in both cases to improve the fidelity, no 
maximally entangled states can be generated, in general. That is, the fixed point of 
the maps described by Eqs. (|20l2ip depends on the coefficients /i^fc and specifically on 
the fidelity of the elementary pair [49] . 

As elementary pairs can be generated on demand, they do not need to be stored. 
Hence in A and B only two qubits need to be stored (corresponding to the pair to be 
purified and the elementary pair, respectively). The reduction in spatial resources 
leads however to an increase of temporal resources. In protocols BBPSSW and 
DEJMPS, the purification of different pairs corresponding to a single purification 
step can be implemented in parallel (i.e. the temporal resources are given by the 
number of steps). That is, one actually considers a distillation procedure where out 
of many low-fidelity entangled pairs a few with higher fidelity are generated. The 
probabilistic character of entanglement purification manifests itself in the fact that 
many identical pairs need to be simultaneously available. In entanglement pumping, 
in contrast, the probabilistic character of purification leads to increased number of 
required repetitions, as in case of an unsuccessful purification step the procedure has 
to be started from beginning and pairs are sequentially generated. 

One can improve the entanglement pumping scheme in such a way that the 
number of qubits that have to be locally stored remain small {~ 4 for practical 
purposes), while it is possible to generate maximally entangled states rather than 
only enhancing the fidelity by a finite amount. The corresponding scheme is called 
nested entanglement pumping [45] and works as follows: At nesting level 1, elementary 
pairs created between Ai and Bi are used to purify a pair shared between A2 and 
B2 via entanglement pumping. The fidelity of elementary pairs at level 1 is given by 
Fi. It turns out that after a few purification steps, the fidelity F2 of the pair A2 and 
B2, is already close to the reachable fixed point. The resulting pair with improved 
fidelity F2 now serves as elementary pair at nesting level 2. That is, an elementary 
pair at nesting level 2 shared between A3 and B3 is purified by means of entanglement 
pumping, where always elementary pairs of nesting level 2 with fidelity F2 shared 
between A2 and B2 are used. The fidelity of the resulting pair A3 and B3 after a few 
purification steps is given by F3 with F^ > F2 > Fi. We remark that an unsuccessful 
purification step at a higher nesting level requires to restart the procedure at the lowest 
nesting level 1. Still, the required temporal resources increase only polynomially. The 
overall procedure can be viewed as a stochastic process, or equivalently as a one- 
sided bounded random walk. With each nesting level, one additional particle has to 
be stored at each location. However, it turns out that for practical purposes (say 
required accuracy of eo = 10"'') a few nesting levels (~ 3) suffice to generate states 
with fidelity -F > 1 — eo |45j . Hence the storage requirements remain very moderate, 
while the required temporal resources increase only polynomially. 
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Figure 3. (a) Schematic representation of entanglement pumping. An 
elementary pair (pair 1) with fidelity xq is repeatedly created and used to purify 
the second pair. The fidelity converges to some fixed point Xg" < 1. (b) Nested 
entanglement pumping. At nesting level 1 , elementary pairs of fidelity xq are used 
to purify the second pair to fidelity Xq''. At the next nesting level, pairs of fidelity 
Xq'' produced in this way serve as elementary pairs and are used to purify one 
pair to fidelity Xj" via entanglement pumping. Pairs of fidelity x are then used 
as elementary pairs at the next nesting level. 



3.3. N -y M protocols 

The protocols discussed in the previous Section operate on two copies of a given mixed 
state, and produce one copy as output if they are successful. More general protocols 
are conceivable that operate on N input copies of the state and produce M copies as 
output. We will refer to such protocols as — > M protocols, and discuss them in this 
subsection. A protocol of this kind of particular importance is the so-called hashing 
protocol, which operates in the limit N, M — > oo. The general idea behind N ^ M 
protocols is very similar as in the case of standard recurrence protocols operating on 
two copies: To obtain information about a sub-ensemble -in this case consisting of 
M copies of the state-, for which the remaining N — M copies are measured after 
applying suitable local operations. 

3.3.1. N M protocols for finite N The 2^1 recurrence protocols discussed in 
the previous section can be considered as two-step procedures. In a first step, the 
two copies of the input state are manipulated by local operations that entangle the 
two pairs. The effect of these local operations on Bell diagonal states is a certain 
permutation of the basis elements. In a second step, the second pair is measured, and 
depending on the outcome of the measurement the first pair is either kept or discarded. 
General N ^ M protocols operate in a very similar fashion. In fact, in Ref. [50] all 
possible permutations achievable by local operations have been constructed for qubit 
systems, and accordingly a large number of possible N ^ M entanglement purification 
protocols were constructed and analyzed. It was found that in certain regimes such 
N ^ M protocols operate more efficiently (i.e have a higher yield) than standard 
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2^1 protocols [Sni m] ■ Typically, for small initial fidelities the ratio of final pairs M 
to initial pairs N may be small, M/N ^ 1, while one expects that M/N « 1 for large 
fidelities as only a small amount of information about the remaining ensemble needs 
to be revealed. Generalizations of this concept to the purification of entangled d-level 
systems are possible [52] (see also e.g. Refs. [53l [SH [55] for entanglement purification 
protocols of d"level systems). 

We would also like to remark that a general connection between error correcting 
(stabilizer) codes and N M purification protocols exists [38], which we describe 
later in more detail. In fact, for each code one can construct a corresponding N ^ M 
entanglement purification protocol. 

3.3.2. Hashing and breeding protocols Hashing protocols can be considered as special 
instances of iV ^ Af protocols that operate in the limit — oo. Hashing was 
introduced in Ref. [2i|. The basic idea is similar as in N M recurrence protocols. 
Here, random subsets of size n out of the total N copies of the state are chosen, and 
bilateral local CNOT operations with each of the n pairs as source, and one selected 
pair as target, are performed (or vice versa, i.e. the selected pair as source). The 
selected pair is finally measured, revealing one bit of information about the remaining 
ensemble. Measurements of this kind are repeated m times. One can in fact show 
that the information gain per measurement is close to one bit. 

Hashing is conceptually closely related to breeding, which might be slightly easier 
to understand. In the case of breeding, the parties are assumed to possess, in addition 
to the N copies of the state, m pre-purified, maximally entangled Bell pairs which are 
used to gain information about the remaining ensemble. In the asymptotic limit of 
large N the density matrix is approximated to an arbitrary high accuracy by its 
"likely subspace approximation" , i.e. the density matrix F obtained by projecting p®^ 
into a subspace P (the likely subspace), where the dimension of P is 2('^('''+'')^. In the 
case of Werner states pw{F) (see Eq. [161 F — (3a;+l)/4), this likely subspace contains 
essentially states of the form | and permutations thereof, where 

moo = FN, moi = rriio = mn = (1— i^)/3iV[[J. That is, the density matrix can be 
interpreted as an equal mixture of all these possible configurations, where the number 
of Bell states is essentially fixed to ruij, while the order (or position) of the states 
is unknown. The number of possible configurations of states of this form is -for large 
N- approximately given by 2^^^^\ where S{F) = -FXog^F - (1 - F)\og^{^). 
The task thus reduces to reveal which of these possible configurations one is dealing 
with. Clearly, this requires NS{F) bits of information. Since one can gain at most 
one bit of information about the ensemble with help of each maximally entangled 
pair, one needs m = NS{F) additional maximally entangled pairs to perform this 
task. Having obtained the required information, one possesses a pure state consisting 
of N Bell states (in different bases), i.e. some (known) permutation of the state 
^jjl'l'y )^'"'^ I- Since m = S{F)N maximally entangled pairs have been 

consumed during the process, the total yield of the breeding protocol is given by 
D = 1- S{F). Note that S{F) = S{pw), where S{pw) = -tiipw^og^ pw) is the 
von-Neumann entropy of pyy. It follows that for Werner states, breeding only works 
if the initial fidelity is sufhciently high, F > 0.81. 

A similar kind of reasoning can be applied to hashing, where no pre-purified pairs 

II To be precise, one has to consider in addition also states with moo = (FN i: 0{\/~N)) and similarly 
for ma. 
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are required. The analysis is slightly more involved since one has to take a kind of 
back action (influence of the remaining pairs because the measured pair was not in a 
pure state) into account. The yield of the hashing procedure is, however, exactly the 
same as for breeding. For Bell-diagonal states, one obtains that the yield of hashing 
protocols is given by D{p) = 1 — S{p). 

The yield of hashing and breeding protocols can be further improved if two-way 
classical communication is allowed, see e.g. Ref. |56[ 157] . The underlying principle 
for this improvement is discussed in Ref. [57] . In addition, one can generalize hashing 
and breeding to d dimensional systems for prime d |58| . The optimal entanglement 
distillation protocol for two-way classical communication is in general unknown (see 
however |59l[60]). Only for specific two qubit states, for instance incoherent mixtures 
of two Bell states, the known upper bounds on the yield coincide with the achievable 
rate for known protocols, in this case the hashing protocol. When assuming only one- 
way classical communication, the problem becomes tractable. In fact, the optimal 
distillation protocol for one-way classical communication was obtained in Ref. |61| . 

4. Quantum error correction &; entanglement purification 

The two possible solutions to the problem of quantum communication over noisy 
channels, quantum error correction and entanglement purification plus teleportation, 
have already been discussed in Sec. [2l Here we show that the approaches are in 
fact equivalent when considering one-way classical communication. In addition, we 
discuss a systematic way how to construct entanglement purification protocols from 
quantum error correction codes. We treat not only the (straightforward) case of one- 
way protocols, but also protocols that make use of two-way classical communication. 

Equivalence between QECC and one-way EPP 

The close relation between quantum error correction codes and schemes based on 
one-way classical communication has been proven in an early paper [2]. Consider a 
quantum channel £ and the associated bipartite mixed state 

E :^t®£\<^){<^\ (22) 

that is obtained by sending part of a maximally entangled state |$) through the 
channel £. Consider also the channel S which is generated when using a state E 
for teleportation. Notice that for Pauli-diagonal channels S-p (see Eq. [5]) we have 
E-p = E-p and Ep = Ep. 

In Ref. [2] two inequalities are shown which establish this relation: 

(i) > Q-^ 

(ii) < 

The two inequalities are proven by establishing explicit protocols. Regarding (i), 
one considers the QECC which leads to channel capacity Qj*. The second particles 
of m locally prepared maximally entangled pairs are encoded using the QECC and 
teleported to B using several copies of the mixed state E. At B, the decoding operation 
is applied and errors are corrected. This leads to m maximally entangled states, and 
we have in fact described for any E a one-way entanglement purification protocol 
which reaches equality in (i), and hence (i) is fulfilled. 
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Regarding (ii) , one considers the entanglement purification protocol V that leads 
to D~^. One creates several copies of the bipartite mixed state E by sending the 
second particle of a maximally entangled states through the channel, and uses V to 
generate maximally entangled pairs with rate . These pairs are then used for 
(perfect) t deportation, and we have constructed in this way a coding scheme which 
reaches equality in (ii), and hence (ii) is fulfilled. 

Notice that in the case of Pauli-diagonal channels (and also for some other 
channels), (i) and (ii) show the equivalence between one-way entanglement purification 
and quantum error correction in the sense that one-way distillable entanglement and 
channel capacity are the same, 

De^QT- (23) 

4-2. One- and two-way entanglement purification protocols from CSS codes 

For Pauli-diagonal noise channels (Eq. [2|)), also a direct way how to derive a QECC 
from certain one-way entanglement purification protocols has been established in Ref. 
[2]. One can turn the construction around, which leads to a constructive way of 
obtaining one-way entanglement purification protocols from a certain class of QECC, 
the CSS codes [161 [13]. This approach can also be generalized, as shown by Aschauer 
in his PhD thesis [38], in the sense that not only entanglement purification protocols 
using one-way classical communication, but also protocols making full usage of two- 
way classical communication can be constructed from CSS codes (see also Rcfs. [62 , 6^ 
for alternative approaches). In particular, for each CSS code that uses n physical 
qubits to encode k qubits, one can construct an entanglement purification protocol 
that operates on n initial copies of two-qubit states and produces k purified pairs as 
output. 

There are two possible operational modes for such entanglement purification 
protocols 

(i) error correction mode 

(ii) error detection mode 

In case of (i) only one-way classical communication is used, and the k output pairs 
are kept dcterministically. Measurements on the remaining n — k copies are used to 
gain information on the ensemble, and the measurement outcomes determine the error 
correction operation to be applied to the remaining copies. As shown in Ref. [38], 
entanglement purification protocols can also run in an alternative mode (ii) where 
one makes use of two-way classical communication. The information gathered in 
the measurement of the (n — k) pairs is used to decide whether the remaining pairs 
should be kept or discarded. The ones that are kept have a higher fidelity than before. 
This operational mode is the standard mode for recurrence protocols as discussed 
above, and in fact turns out to provide a larger purification range and favorable error 
thresholds. 

We now illustrate this construction (for details we refer the reader to Ref. [35] ; see 
also Fig. [4]) . To this aim, consider a Pauli-diagonal channel £-p which we will denote 
simply by £ here. Consider also a mixed state E which is obtained by sending one 
particle of a maximally entangled state 1$) through the channel, Eq. (|22|) . For any 
CSS code described by coding operations C and decoding operations T>, it is shown 
how to obtain an entanglement purification protocol. Notice that C,T> are Clifford 
networks (i.e. composed only of Clifford operations), where C consists of an encoding 
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Figure 4. Schematic representation of how to construct an entanglement 
purification protocol from an error correction CSS code. Figure taken from [38) . 



unitary operation Uc^ while the decoding operation is given by a unitary operation 
Ud = Uc followed by single qubit measurements in the eigenbasis of az on the last 
n — 1 qubits. We make use of the identity 

C/^®1s|$+)^5-1a®C/||$+)^b, (24) 

which holds not only for all unitary operations U , but in fact for any linear operator. 

We consider first a QECC where one qubit is encoded into n physical qubits. The 
transmission of (unknown) quantum information from A to B using such a QECC 
takes place by encoding the unknown state at A into n qubits, sending it through the 
noisy channel 5®" and decoding it at i?, where the decoding operation also includes 
error correction. Let pin the state to be sent and denote by Pq = |0)®"~^(0| the state 
oi n — \ auxiliary qubits. The final state of this procedure is described as 

Pout =2?o£®"oC(pin®Po). (25) 

Consider now an entanglement -based version of the protocol, which involves the 
following steps: 

(i) distribute n copies of a maximally entangled state 10+) through the noisy quantum 
channel 5*^", 

(ii) apply the coding operation C"^ in A, and the decoding operation T> in B. The 
coding operation C"^ is defined as the application of the unitary operation Uq 
followed by single qubit cr^ measurements on the last n — 1 qubits, and similarly 
for V. 
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(iii) use the resulting single entangled pair to teleport the unknown state p\a from 
A to B, where the final correction operations not only depends on the result of 
the Bell measurement in the teleportation protocol, but also on the measurement 
outcomes on the qubits in A and B of the last n — 1 entangled pairs. 

Consider first the case where £ = 1, i.e. a noiseless quantum channel. One can 
use the identity Eq. to show that one ends up with a maximally entangled pair 
that can be used for perfect teleportation. In a similar way, the equivalence of the 
QECC protocol and the entanglement based protocol can be established, where in the 
latter case the proper (Pauli) correction operations need to be apphed. To estabhsh 
this equivalence, it is essential that the noisy channels are Pauli-diagonal and that 
the coding and decoding operation are of Clifford type, because in this case the order 
of all the mentioned operations can be exchanged (up to additional, correctable local 
Pauli operations) and one can make use of Eq. ([M)) . In fact, one finds for such coding 
and decoding operations that the output state of the entanglement-based version of 
the protocol is again given by Eq. ([25]) . 

Steps (i) and (ii) of the above construction (together with a suitable correction 
operation) can be interpreted as an entanglement purification protocol. This is due 
to the fact that an entangled state with improved fidelity can be created in this 
way whenever the QECC allows one to reduce the influence of channel noise. Using 
standard error correcting CSS codes, one obtains one-way entanglement purification 
protocols, as the measurement results are only used to determine the appropriate 
correction (Pauli) operation. However, here one has also the freedom to discard the 
resulting pair for certain measurement outcomes, which corresponds to the usage of an 
error detection code |38| . Information exchange between A and B of the measurement 
outcomes is required, and hence two-way classical communication is involved. Notice 
that in entanglement purification one is allowed to discard certain pairs. This is in 
contrast to the direct transmission of quantum information, where discarding the 
state would yield to a loss of quantum information. One can simply repeat the 
purification protocol until one succeeds in producing a purified output pair. Only then 
the (unknown) quantum information is teleported from A to B. On the other hand, 
when sending encoded quantum information directly through the noisy channel, usage 
of error detection codes leads to unrecoverable loss of quantum information. Hence 
two-way entanglement purification protocols constructed in this way are superior to 
quantum communication schemes based on QECC. 

Notice that the same construction can also be applied for CSS codes where k 
qubits are encoded into n physical qubits, and one obtains entanglement purification 
protocols which produces from n noisy entangled pairs k purified pairs [38]. 




5. Entanglement purification with imperfect apparatus 

In this section, we investigate the performance of entanglement purification protocols 
under non-idealized conditions, i.e. for noisy local control operations. The main 
effect of noise is that no longer maximally entangled states can be produced, and 
the achievable fidelity is limited to values smaller than unity. Similarly, the required 
initial fidelity in the case of noisy local control operations is larger. While recurrence 
protocols remain applicable, hashing and breeding protocols become impractical. 
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5.1. Distillable entanglement and yield 

Using the standard definition of distillability and yield is clearly inappropriate in the 
case of imperfect local operations. In particular, no maximally entangled pure states 
can be created in this case. This implies that no state will be distillable, and that the 
yield is zero. We therefore have to modify the definition of distillability and yield to 
account for these facts. 

Rather than demanding that maximally entangled pure states can be created 
(fidelity F = 1), we will consider the creation of states with certain target fidelity. 
Distillability refers in this case to the possibility of approximating a given target state 
\tp) with fidelity F > F^. Clearly, such a definition of distillability depends on both 
the required target state jV') and the desired fidelity F^. To be more precise, we say 
that a given mixed state p is distillable with respect to a target state and fidelity 
Fc if one can generate from possibly many copies of p by means of local operations 
and classical communication a state a such that the fidelity of a with respect to 
is larger or equal than F^ F = {tp\a\'ip) > Fc. 

We consider the yield of purification procedures corresponding to this notion of 
distillability, Dp,F^. In this case, however one needs to specify the exact structure 
of target states. In particular, when considering general distillation procedures (e.g. 
N —>■ M protocols), one obtains as output a mixed state F of a large number of 
particles. Here we will demand that the output state F is a tensor product of states 
(Tfc, F = CTi ® . . . (g) (Tm, where each of the Cfc fulfills (V'|crfc|V') > Fc- That is, we 
require that after the purification procedure one possesses independent copies of the 
state with desired fidelity. One may also use the weaker criterion that all reduced 
density operators dk (corresponding to different output "copies" of the output state) 
have fidelity F > F^ where dk are obtained from F by tracing out all particles but 
the ones corresponding to state k. In this case, however, it is not clear whether the 
different output states can be independently used for all applications. While their 
fidelities certainly fulfill F > Fc, there might be classical correlations among the 
output states that are limiting their applicability, e.g. for security applications such 
as key distribution. 

In this context it would be interesting to see whether the definition of yield with 
respect to fidelities of reduced density operators is equivalent to the one we use here. 
To this aim, one would need to show that one can produce from an ensemble of 
states where all reduced density operators have a sufficiently high fidelity an ensemble 
which consists of a tensor product of copies, where the size of the ensembles might be 
diminished by a sub-linear amount, or the fidelity be reduced by some (arbitrarily 
small) 6f. Such a "purification of classical correlations" has, however, not been 
reported so far. 

5.2. Error model 

To analyze the influence of noisy local operations, we will consider a simple error model 
where only two-qubit operations are noisy, and the noise is of a simple form. More 
general error models, including correlated noise and also errors in measurements, have 
been analyzed, leading to a similar qualitative behavior of entanglement purification 
protocols }49 l 145 1 164]. 

We model a noisy two-qubit operation U by first applying local noise to each of 



CONTENTS 



24 



the qubits, followed by the perfect unitary operation U, 

Skip = Uki[MkMip]Ul. (26) 

We will mainly assume local completely positive maps A4k, Mi corresponding to white 
noise (depolarizing channels), 

1 ^ 

A^feP = pp+(l-j,)-^af paf . (27) 

In some cases, we will consider even more restricted noise models, namely local 
dephasing channels (or phase flip channels), 

M^p ^PP+il-p)lip + crt^paf^). (28) 
and local bit-flip channels, 

M^p = pp+{l- p)\{p + V'xf ^ (29) 

5.3. Bipartite recurrence protocols 

We start by analyzing the BBPSSW protocol, where we consider the error model 
specified in Sec. 15.21 with local white noise, Eq. (|77|) . Given two copies of a Werner 
state Eq. (fTB)) . the influence of noisy local control operations — in this case noisy 
CNOT operations — can be readily obtained. The action of noisy bilateral CNOT 
operations is the same as applying noiseless bilateral CNOT operations to two copies 
of Werner states with reduced fidelity. In particular, one finds that the parameter x 
is mapped to xp^ due to the local depolarizing noise. That is, one applies the original 
protocol to two copies of Werner states pwixp^). Rewriting Eq. i.e. the fidelity 

of output state as function of input state, in terms of parameter x — {AF — l)/3, 
one obtains x' = {Ax"^ + 2x)/{?>x'^ + 3). Taking into account the effect of noisy 
local operations, i.e. the reduction of x, we obtain that the output state after one 
purification step is again a Werner state pw{x') with 

_ 4xV + 2a:p^ 

" 3xV + 3 ■ ^ ' 

The purification curve (fidelity of output state plotted against fidelity of input state) 
corresponding to the noiseless protocol is shifted down (see Fig. [5]) . 

It is now straightforward to determine the purification range of the protocol, 
i.e. maximal reachable fidelity as well as the minimal required fidelity such that 
entanglement purification can be successfully applied. These quantities are given by 
the fixed points of the map Eq. ([3D]). One finds 

a^± = ^±^V4 + 6p-2_9p-4^ (31) 

where the maximum reachable fidelity -Fmax = (32^+ + l)/4 and the minimum required 
fidelity Fmin = (3a;_ + I)/4. The threshold value for p such that a finite purification 
interval remains (i.e. a;+ > a;_) is given by Pmin — 0.9628. This implies that errors of 
the order of four percent are tolerable. 

One can perform a similar analysis for the DEJMPS and (nested) entanglement 
pumping protocol. There, the fixed points of the corresponding non-linear maps 
are more difficult to obtain analytically. One can, however, perform the analysis 
numerically and obtains the following results [49l |45] 
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Figure 5. Purification curve for BBPSSW protocol. Gain in output fidelity 
x' — X, plotted against input fidelity x. Curves from top to bottom correspond to 
error parameters p = 1, 0.99, 0.98, 0.97 respectively. 



(i) the maximum reachable fidehty Fmax for the DEJMPS protocol is significantly 
higher than for the BBPSSW protocol; 

(ii) the minimal required fidelity F^i^ for the DEJMPS is significantly smaller than 
for the BBPSSW; 

(iii) the threshold for noisy operations, described by Pmin is smaller for the DEJMPS 
protocol; 

(iv) the reachable fidelity, minimum required fidelity and threshold for noisy 
operations seem to be the same for nested entanglement pumping and for the 
original DEJMPS protocol _45j. 

When assuming errors in local operations corresponding to correlated white noise and 
errors in measurements of same order of magnitude [H], one finds tolerable errors 
of about three percent for the BBPSSW protocol, and five percent in case of the 
DEJMPS protocol. 

5.4- N M protocols 

In a similar way, one can analyze the influence of noise for general N — > M protocols. 
In Ref. 0S], a number of protocols corresponding to different CSS codes (via 
the construction presented in Sec. 14. 2p have been analyzed with respect to their 
purification range, maximal reachable fidelities and error thresholds. Both operational 
modes, error correction mode and error detection mode have been considered. As can 
be expected due to the equivalence to QECC, the correction modes turn out to have 
a smaller purification range and much stringent error thresholds. When compared 
to standard recurrence protocols that operate on two copies, some of these N ^ M 
purification protocols turn out to have an improved yield in certain regimes. 
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5.5. Hashing protocols 

For perfect local operations recurrence protocols have zero yield, while hashing 
protocols, operating simultaneously on an asymptotically large number of copies, have 
a non-zero yield. For imperfect local operations, the situation changes drastically. 
When requiring output states to have only a certain F > Fc, one finds that recurrence 
protocols may have a non-zero yield as long as Fc < Fmax, i-e. as long as the required 
fidelity is smaller than the fidelity reachable by the protocol. At the same time, the 
hashing protocol fails completely in the case of imperfect local operations. The reason 
for this is that one operates on an infinite number of states to ^ cx) to reveal one 
bit of information. That is, one performs m bilateral CNOT operations with a given 
copy always serving as target state. As each of the CNOT operations is noisy, noise 
is accumulated in the target state. Assuming that the target state was initially in a 
maximally entangled pure state, the target state ends up in a Werner state pwiv^"^)- 
Clearly, if the amount of noise is too big, no information about the remaining ensemble 
can be extracted. This is the case for sufficiently large to, in particular for to — * cx3, 
even if p is close to 1. In other words, the information loss due to imperfect local 
operations exceeds the possible information gain per measurement (maximum one 
bit). This implies that hashing in its original form can not be applied in the case of 
imperfect local operations. 

6. Applications I 

6.1. Quantum communication and cryptography 

As discussed in Sec. [2l entanglement purification together with teleportation offers 
a way to achieve perfect transmission of unknown quantum information over noisy 
channels. This approach can also be used for quantum key distribution in the context 
of quantum cryptography. 

In the case where not only the channels but also the local operations are imperfect, 
entanglement purification can still be applied. As we have seen in the previous 
section, one can increase the fidelity of entangled states -and hence the quality of the 
channel when using the purified entangled states for teleportation. More importantly, 
the entanglement produced by entanglement purification, although not perfect, is 
private [65j . That is, although no maximally entangled states can be produced, any 
eavesdropper will be factored out asymptotically. Hence a secret key can be established 
between two parties, even in the presence of noisy channels and imperfect apparatus 
|65| . This provides an alternative way of proving unconditional security of quantum 
key distribution, and is an important application of entanglement purification for 
quantum cryptography. We also mention that a direct and rigorous proof of the 
security of quantum cryptography that makes use of entanglement purification has 
been put forward (see e.g. Refs. [5S1[^[55] ). 

6.2. The quantum repeater 

In the context of quantum communication, a central problem is to go to large distances. 
When using photons, the absorption probability scales exponentially with the distance, 
and so does the influence of errors e.g. due to dephasing. This is a general, unavoidable 
feature of classical and quantum communication channels, and hence has to be dealt 
with in some way. The standard classical approach of amplifying the signal at 
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intermediate repeater stations cannot be directly adopted in the case of quantum 
communication. This is due to the fact that general quantum signals, i.e. unknown 
quantum states, cannot be cloned or amplified. 

One possible solution is given by entanglement-based communication schemes, 
where entangled pairs are distributed over noisy quantum channels and then used 
to transmit arbitrary quantum information via teleportation. A nested sequence of 
connection (i.e. entanglement swapping) and entanglement purification steps thereby 
provides a way to avoid an exponential scaling of the resources with the distance. 
This scheme is known as the quantum repeater (see e.g. [IHl HHl [Ml EOl EH EH ESI 
El EH EH EH EH)- As shown in Refs. [48l|49], one can establish entangled pairs over 
arbitrary distances with only polynomial overhead in the physical resources (number 
of required short distance pairs, parallel channels, repeater stations and time) even if 
local control operations are noisy (and local memory errors can be controlled [70 ). 
The error thresholds for noisy local operations are of the order of percent. 

A brief sketch of the repeater protocol follows: For communication over a distance 
NIq we split the channel into N segments of length and place repeater stations 
at distances fc/g, k — 0,1, . . . , N. We assume that Iq is sufficiently small such that 
the resulting state, when sending part of a maximally entangled state through the 
channel, is still distillable entangled and the absorption probability is sufficiently 
small. For optical fibers, distances of (several tens) of kilometers are reasonable. 
For simplicity, we assume that we have 2" such segments, i.e. TV = 2". Several 
copies of short distance elementary pairs shared between all repeater stations are 
generated and purified to some working fidelity Fq. At repeater stations 2, 4, 6, etc. 
two adjacent elementary pairs are connected by performing entanglement swapping, 
thereby generating entangled pairs over distance 2lo with reduced fidelity shared 
between repeater stations (1, 3); (3, 5); . . .. Purification of several copies of these pairs 
to the working fidelity Fq results in a similar situation as previously, however the 
elementary pairs extend now over the distance 2lo. Proceeding in this way, we obtain 
a nested scheme where the distance of the entangled pairs is doubled at each nesting 
level. At nesting level n, we obtain long distance entangled pairs of length 2"lo with 
fidelity Fq . It is straightforward to check that this scheme leads to a polynomial scaling 
of the resources with distance [48] . The setup of the repeater is schematically sketched 
in Fig. [6l while Fig. El shows a elementary purification loop. The total number of 
required elementary short distance pairs are shown in Fig. |8l 

Variations of the scheme based on the usage of different purification protocols 
-e.g. (nested) entanglement pumping rather than standard DEJMPS protocol- have 
also been discussed and lead to a significant reduction of spatial resources (storage 
particles) to n + 1 cx log(A'') at the cost of increased, although still polynomial, 
temporal resources [481 149] . Further improvement to a constant overhead in spatial 
resources is possible (see Ref. [69]). 

6.3. Improving error thresholds in quantum computation 

Under certain circumstances, entanglement purification can be used directly to weaken 
the requirements for fault-tolerant quantum computation [45j . Consider a situation 
where n systems, each of them possessing d degrees of freedom, are available. For 
instance, one may think of n neutral atoms or trapped ions, each of them constituting 
a d-level system. While typically only two of the levels are used for quantum 
computation, in principle more levels are available. In such a situation, one can 
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Figure 6. Schematic sketch of the repeater setup. Connection and entanglement 
purification is used to generate large distance entanglement pairs with high fidelity. 




Figure 7. Purification loop: Connection of L elementary pairs and re- 
purification to initial fidelity F. In the text, L = 2 is assumed. Figure taken 
from Ref. [H]. 



show that the threshold for fauh-tolerant quantum computation essentiahy only 
depends on the fidelity of single-system operations [45]. Two-system operations, i.e. 
interactions between two systems, are typically more difficult to realize than single- 
system operations (e.g. operations on a single atom). However, it turns out that 
one can tolerate a noise level of more than 50% for two-system operations, while still 
achieving fault tolerant quantum computation as long as the single system operations 
are of sufficiently high fidelity. 

The basic idea is to use each d-level system to represent one qubit for 
computation, while the remaining degrees of freedom serve as auxiliary levels. The 
noisy two-system interaction serves to entangle auxiliary degrees of freedom, and 
one may use entanglement purification to increase the fidelity of this entanglement. 
Finally, high fidelity entangled states are used to realize two-system gates, e.g. by 
means of teleportation based gates [IS [80l [H [82l [83l [84] . The fidelity of the two- 
system gate is essentially determined by the fidelity of the entangled state, which, in 
turn, is determined by the fidelity of single-system operations used in entanglement 
purification. 



CONTENTS 29 

L ^ 



Figure 8. Nested purification with an array of elementary EPR pairs. At each 
nesting level, L elementary pairs are connected and re-purified using M copies, 
where in the text L = 2 is assumed. This yields to a polynomial scaling of the 
total elementary pairs with the distance. Figure taken from Ref. 48 . 



We remark that at least four auxiliary levels should be available. By using nested 
entanglement pumping, as discussed in Sec. I3.2.4i it turns out that for parameter 
regimes of practical importance, a few (2-3) nesting levels are sufficient to obtain high 
fidelity entanglement. This translates into a total requirement of about 16 levels per 
system, and a required error threshold of about 10~^ for single system operations 
to achieve errors of 10"'' for (logical) two-system operations, which is sufficient to 
achieve fault tolerant quantum computation. This is illustrated in Fig. [SI The error 
rate of the physical two-system operation can, however, be almost arbitrarily large 
(more than 50%), and the two-system gates can even be probabilistic. 




Single particle gate error rate p 



Figure 9. Double logarithmic plot of achievable logical two-qubit gate error rate 
against single— particle error rate p for fixed error rate of physical two-particle 
interaction of (a) 1.5 * 10~^, (b) 10"'^. Curves from top to bottom correspond 
to no entanglement purification, entanglement pumping using 1, 2, 3 (or more) 
nesting levels respectively. Figure taken from Ref. | 45| . 



A combination of (dynamical) decoherence free subspaces and entanglement 
purification is also conceivable. In Ref. [85j , an entanglement purification protocol 
for spin degrees of freedom in electrically controlled semiconductor quantum dots has 
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been put forward. The protocol is capable of purifying encoded states. The encoding 
is used to protect quantum information from dominant noise processes and is based on 
a dynamical decoherence free subspace. The purification protocol is capable to deal 
with other types of errors, where not only errors within the logical subspace, but also 
leakage errors can be handled. The purification protocol is constructed in such a way 
that it only makes use of resources available in such devices. One may also combine this 
encoded entanglement purification with a teleportation-based approach to implement 
non-local quantum gates, leading to an alternative way to obtain logical two-qubit 
gates for (fault-tolerant) quantum computation. Such a proposal for electrically 
controlled quantum dots has been put forward in Ref. |86| . 

7. Entanglement purification protocols in multipartite systems 

We now turn to multipartite systems of n spatially separated parties. We start 
by reviewing the concept of graph states, a family of n-qubit states of particular 
importance. Then we consider entanglement purification protocols for such graph 
states. The first protocol of this kind was introduced in Ref. [57] and further analyzed 
in Ref. [5T], and it is capable of distilling n-party GHZ states. Here, we will discuss 
recurrence and hashing protocols for all stabilizer states, or equivalently, all graph 
states. These protocols where introduced in Ref. 881] and further elaborated in [Mll90j . 

7.1. Graph states 

We start by defining graph states. A graph G = (V, E) is given by a set of n vertices 
V = {1,2, ...,n} connected in a specific way by edges E ^ V^. To every such 
graph there corresponds a basis of rt-qubit states {|$;i)G}i where each of the basis 
states |$/j.)g is the common eigenstate of n commuting correlation operators with 
eigenvalues (—1)^^, — /ii/i2 . . ./in- To relax notation, we will sometimes omit the 
index G and assume that an arbitrary but fixed graph G is considered. Graph states 
fulfill the set of eigenvalue equations 

Kf\^^)G^hir^'i>^)G, (32) 

j = 1, . . . , n. The correlation operators are uniquely determined by the graph G and 
are given by 

K,='T^^ n ^i'^- (33) 
{fej}e-E 

A graph is called two-colorable if there exists two groups of vertices, Va,Vb such that 
there are no edges inside either of the groups, i.e. {k, 1} ^ E ii k,l ^ Va oi k,l ^ Vb. 
For graph states associated with two-colorable graphs, which we call two-colorable 
graph states, we will split the multi-index fi into two parts, fi = fiAjfJ'B, belonging 
to subsets Va and Vb respectively. See Fig. [10] for examples of two-colorable graph 
states. 

Graph states have first been introduced in Ref. |91| . generalizing the notion 
of cluster states as introduced in Ref. 92J. For the related notion of graph codes 
see [93] [l^. A detailed investigation of their entanglement properties has been 
given in the paper by Hein et al. [95], see also Ref. [96] for a recent review. 
Graph states occur in various contexts in quantum information theory, in which 
multi-party quantum correlations play a central role. Examples are multi-party 
quantum communication, measurement-based quantum computation, and quantum 
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Figure 10. Examples of two— colorable graphs which correspond to (a) GHZ 
state; (b) linear cluster state; (c) two-dimensional cluster state. Vertices with 
same color are not connected by edges. Figure taken from Ref. [109) . 



error correction. Prominent examples of two-colorable graph states are GHZ states, 
cluster states [92] and codewords of error correction codes [93l[94j (see e.g. Ref. [89]). 
In fact, as shown in [lOlj . two colorable graph states are equivalent to codewords of 
CSS codes. We also remark that the correlation operators {Kj} are the generators of 
the stabilizer group of the state |$o)g, and the corresponding description in terms of 
the stabilizers is also referred to as the stabilizer formalism [121 EI] ■ 

We will also consider mixed states p, which for a given graph G can be written 
in the corresponding graph state basis 

P = 5]A^.|<I>^>(<i>.|. (34) 

We will often be interested in fidelity of the mixed state, i.e. the overlap with some 
desired pure state, say |$o)g, F = ('i'olpl^o)- We remark that depolarization of p to 
a standard form pc, 

Pg=EVI<I'/^)(*mI (35) 

can be achieved by randomly applying correlation operators Kj \88\ I89j which is 
a multi-local operation. The diagonal elements, in particular the fidelity, are left 
unchanged by this depolarization procedure. Note that both the notation and the 
description of the depolarization procedure are similar to the ones used for Bell states, 
which are in fact graph states with two vertices, connected by a single edge. 

7.2. Recurrence protocol for two-colorable graph states 

In the following, we will discuss a family of entanglement purification protocols that 
allow one to purify an arbitrary two-colorable graph state. To be precise, for each 
two colorable graph there exists a purification protocol which allows one to obtain the 
pure state |$o)g as output state, provided the initial fidelity is sufficiently large. The 
recurrence scheme |88l I89j for purifying a two-colorable graph state is very similar 
to the BBPSSW and DEJMPS protocol for purifying Bell pairs. We consider two 
sub-protocols, PI and P2, each of which acts on two identical copies pi — p2 = p, 



CONTENTS 



I 1 1 f I f M I 



Figure 11. Schematic representation of the multiparty entanglement purification 
for a ID cluster state. 



pi2 = pi ® P2- The basic idea consists again in transferring (non-local) information 
about the first pair to the second, and reveal this information by measurements. 

In sub-protocol PI, all parties who belong to the set Va apply local CNOT 
operations to their particles, with the particle belonging to p2 as source, and pi as 
target (see Fig. [11]). Similarly, all parties belonging to set Vb apply local CNOT 
operations to their particles, but with the particle belonging to pi as source, and p2 
as target. The action of such a multilateral CNOT operation is given by [55] 

> (36) 

where /xa © denotes bitwise addition modulo 2. 

The second step of subprotocol PI consists of a measurement of all particles of p2, 
where the particles belonging to set Va \Vb\ are measured in the eigenbasis {|0)a;, |l)a;} 
of (Tj; [{lO)^, \l)z] of (Jz] respectively. The measurements in sets A [B] yield results 
(— 1)^^ [(—1)^*=], with S,j,C,k G {Ojl}- Only if the measurement outcomes fulfill the 
condition (^j + j}<=E Cfc)™C)d2 = Vj' — which implies that the eigenvalues of all 
corresponding correlation operators Kj, j e Va are +1, or equivalently /XAQt'A = — 
the first state is kept. In this case, one finds that the remaining state is again diagonal 
in the graph-state basis, with new coefficients 

^Ta-Tb = ^ ^ ^^'^TA.i^B -^Ta.Pb I (37) 

{ (fB .MB ) I I'B ©MB =-fB } 

where if is a normalization constant such that tr(/5) — 1, indicating the probability of 
success of the protocol. 

In sub-protocol P2 the roles of sets Va and Vb are exchanged. The action of the 
multilateral CNOT operation is in this case given by 

I*^MA,Mb) I*^I^A,1^b) * I^MaSi'A.MB ) I'^I'A.I'BffiMB) J (38) 

which leads to new coefficients 

^-ya.tb ^ 5Z ^^'^'^A,-i'B-^MA,7Bi (39) 

{(l'A.MA)|l'AffiMA=7A} 

for the case in which the protocol P2 was successful. 

The total purification protocol consists in a sequential application of sub- 
protocols PI and P2. While sub-protocol PI serves to gain information about /xa, 
sub-protocol P2 reveals information about fi^. Typically, sub-protocol PI increases 
the weight of all coefficients Aq.^b; while P2 amplifies coefficients A^^_o- In total, this 
leads to the desired amplification of Ao,o- 

The regime of purification in which these recurrence protocols can be successfully 
applied is rather difficult to determine analytically, due to the non-trivial structure 
of the non-linear maps describing the protocol. Numerical investigation have been 
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performed in Ref. [59] j and we refer the interested reader to this article for details. 
For special noise models, e.g. phase noise, the purification regime can be determined 
analytically, and provable optimal protocols with respect to purification range and 
yield can be found '98, 99J. The mixed states considered under such a phase noise 
model are, in fact, thermal states of many-body spin hamiltonians defined via the 
corresponding graphs 98J. We remark here that the fidelity does not provide a 
suitable measure to compare purification regimes for different number of particles n, as 
typically the required fidelity will decrease exponentially for all states. This is related 
to the exponential growth of the dimension of the Hilbert space with the number of 
particles n. One can alternatively consider the maximum acceptable amount of local 
noise per particle such that the state remains distillable by means of the recurrence 
protocol. That is, one assumes that each of the particles belonging to a given graph 
state is sent through a noisy quantum channel (e.g. a depolarizing channel) to its 
final location. One then finds for linear cluster states (or, more generally, all graph 
states with a constant degree) that the maximum acceptable amount of noise per 
particle is essentially independent of the particle number. For GHZ states, however, 
the acceptable amount of noise per particle decreases with increasing particle number. 
That is, GHZ states become more and more difficult to purify as the number of 
particles increases. 



7.2.1. Example: Binary-type mixture It is elucidating to consider the purification of 
a special family of states in some detail. We consider the example of mixed states of 
the form 

P^ = X!Va,o|*ma,o)(*ma,o|. (40) 

MA 

These states arise e.g. in a (hypothetical) scenario were all particles within set Va 
are only subjected to phase flip errors (described by az), while all particles within set 
Vb are subjected to bit flip errors (ax). The iterative application of protocol PI is 
sufficient to purify states of the form Eq. (|40|) , as only information about fiA has to 
be extracted. A single application of protocol PI leads again to a state of the form 
p^, with new coefficients 

Va,o = >^1,m/K, (41) 

where K — X^^^a '^ma o a normalization constant indicating the probability of 
success of the protocol. That is, the largest coefficient is amplified with respect to the 
other ones. Iteration of the protocol PI thus allows one to produce pure graph states 
I'I'o.o) with arbitrary high fidelity, given the coefficient Aq.o is larger than all other 
coefficients A^^.o- The family of states p_4 includes states up to rank 2"-^, where 
denotes the number of particles in group A. Depending on the corresponding graph. 
Ha can be as high as n — 1 and hence the rank can be as high as 2"~^. 

As a concrete example, consider the one parameter family pa{F) with Aq^q — F, 
A;xA,o = (1 ^ P)/(2"^ — 1) for /^A 7^ 0, where F is the fidelity of the desired state. 
Application of protocol PI maintains the structure of those states and leads to 

P2 

^ " p2 + (i_F)2/(2"^-I)' ^"^^^ 

This map has P = 1 as attracting fixed point for all states with F > 1/2"-*. The 
probability of success for a single step is given by p = P^ + (1 — P)^/ (2"-* — 1). 
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We also mention that other entanglement purification protocols for two-colorable 
graph states that makes use of error correction and error detection ideas have been 
introduced in Ref. [100] . In particular, states corresponding to different graphs 
are used to purify a given noisy two-colorable graph state. The performance and 
robustness of these protocols with noisy gates is studied analytically, and it is shown 
that schemes with improved yield and scaling behavior can be obtained. 

7.3. Hashing protocol for two-colorable graphs states 

In a similar way, one can design a hashing protocol for any two-colorable graph state. 
The first protocol of this type, capable of purifying GHZ states with non-zero yield, 
was introduced in Ref. |51| . Hashing protocols for arbitrary two-colorable graph 
states were presented in Refs. [lOH l89]. The central tool in these protocols is already 
evident from Eqs. ((36|l and ((38|) . These equations state how information about indices 
is transferred from one state to another. Information about all indices belonging to 
set Va is thereby transferred from copy one to copy two by the multilateral CNOT 
operations as specified in the first step of protocol PI, while information transfer 
occurs for all indices corresponding to set Vg when the direction of CNOT operations 
is reversed (as it is done in P2). Again, by determining the parity of the bit values 
for random subsets — which is done in a similar way as for Bell pairs, but here all bits 
belonging to set Va or set Vb can be determined simultaneously — , one can learn the 
required information in such a way that the remaining ensemble is a tensor product of 
pure graph states (one needs to learn the classical information which non-local state is 
at hand). Notice that information transfer also takes place in the opposite direction, 
which is however not used. 

The yield of the hashing protocol approaches unity for any state diagonal in 
the graph state basis with Ao — ^ 1, independent of the specific form of the state. 
This implies that a given mixed state of sufficiently high fidelity F can be purified 
with non-zero yield using the hashing protocol (combined with the depolarization 
procedure) . Protocols with improved yield (by optimizing the information gain of the 
measurements) have been developed in Ref. |102j . 

7.4. Recurrence protocol for all graphs states 

For the protocols described in the previous section, it is crucial that the underlying 
graphs of the states to be purified are two-colorable. It is, however, possible to obtain 
protocols that can purify all graph states. These protocols have been put forward 
in Ref. [90] and we briefly describe the basic idea here. Unlike in the case of two- 
colorable graph states, we have that the protocols do not operate on identical copies 
corresponding to the same graph, but on states corresponding to different graphs. 

Consider a fc-colorable graph G, i.e. a graph where the set of vertices can be 
divided into k non-connected subsets {Vi, V2, . . . , Vfc}. We denote the corresponding 
multi-indices by fj,i,...fik- The purification of the associated graph state |$o)g 
requires the alternating application of k purification protocols. The j*^ protocols 
serves to reveal information about fij, i.e. the indices associated to vertices in the set 
of qubits Vj . 

We will describe the j*^ purification protocol Vj in the following. The protocol 
consists essentially of two steps 
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(i) Generation of a two-colorable graph state corresponding to graph gj from two 
copies of a graph state corresponding to graph G. 

(ii) Purification of one copy of a graph state corresponding to graph G with help of 
the graph state corresponding to graph gj . 

Regarding (i), we define a two-colorable graph gj associated to G as one which 
contains only the edges between the set Vj and the remaining sets {Vi,i ^ j}, but 
where edges between the remaining sets are erased (see Fig. [12] for an illustration). 
That is, the sets {Vi^i ^ j} form a new set Vj = V\Vj. As shown in Rcf. 90J, one can 
generate from two (noisy) copies of a graph state corresponding to graph G a single 
(noisy) copy corresponding to graph gj by applying CNOT gates from the second to 
the first copy for all parties in the group Vj, and from the first copy to the second 
copy for all other parties, followed by Gz measurements performed on all particles of 
the second copy. Notice that CNOT gates between different copies do not only lead 
to a transfer of information, but also change the shape of the graph. In particular, a 
gate GNOTa~^b introduces new edges between the control qubit a and all neighbors of 
the target qubit b (or erases them if they are already there) . In case of two-colorable 
graphs, the overall effect of the multilateral CNOT gates is that no additional edges 
are introduced (or more precisely they cancel each other). Here, the total effect of 
the CNOT operations is that all edges between groups Vi and V are erased whenever 
i,l ^ j in the first copy, i.e. a two-colorable graph state corresponding to the graph 
gj is produced. 

An alternative to the az measurement of the second copy -which effectively simply 
erases the corresponding qubits- is given by measurements in a different basis. More 
precisely, one may measure on all qubits in group Vj , and az on all remaining qubits, 
and accepts the produced state only if the expectation value of the corresponding 
correlation operators Ki, i G Vj are +1. In this way, not only the shape of the graph 
is changed, but also a purification takes place as information about the first copy is 
revealed by the measurements of the second copy. 

In step (ii), we take two noisy states in such a way that the first state corresponds 
to graph G, pa, and the second state to graph gj, pg.. The parties in the group Vj 
apply CNOT gates from the second (control) state pg. to the first (target) state pc, 
while the remaining parties apply the CNOT gate in the opposite direction. The 
second state is measured in the eigenbasis of for all parties in the group Vj and 
in the eigenbasis of tr^ for the remaining parties. The first state pc is kept only if 
all expectation values of the corresponding correlation operators Ki, i £ Vj are +1. 
Again, the CNOT operation transfers information from the first state to the second, 
which is revealed by the measurements. The choice of different graphs for state 1 and 
2 guarantees that the graph corresponding to the first copy remains unchanged. More 
precisely the action of CNOT operations is given by, 

which shows the transfer of information about the stabilizer eigenvalues between the 
two states. Notice the close similarity with Eq. (|38|) . but also the crucial difference 
that here states corresponding to two different graphs are involved. After a successful 
purification step (i.e. obtaining proper measurement outcomes) one finds that the new 
matrix elements of p'q are given by 

{(M5-.''3)lM3©t^J=-)'5} 



CONTENTS 



36 



1 




4 

3-colorable graph G 




9i 92 93 

Figure 12. A 3-colorablc graph G and the 3 corresponding two-colorable sub- 
graphs gi, g2, and g^. gi corresponds to the red color (vertices 2,4 and 6), g2 to 
the green color (vertex 7) and 33 to the blue (vertices 1,3 and 5). Figure taken 
from Ref. l90l . 



where the A's are the diagonal coefRcients of the state pa, and A's are the diagonal 
coefficients of the state pg^ . As consequence, elements of the form Ao.-yj are increased. 
One may say that purification takes place with respect to indices corresponding to 
parties in Vj. 

The whole purification protocol consists of a sequential application of the sub- 
protocols Vj corresponding to all colors j — 1, . . . ,k. Even though there is a back- 
action of noise for the colors which are not purified for the step j, one obtains an overall 
increase of the fidelity Ao if the fidelity of the initial state is sufficiently high. In fact, 
Ao = 1 is an attractive fixed point of the protocol under the ideal local operations, 
which can be checked numerically. 

7. 5. Purification of stabilizer states using stabilizer error correcting codes 

An alternative approach to purifying all stabilizer states has been taken in Ref. 
[lOSj . The multipartite entanglement purification protocols discussed there are 
N M protocols, and stabilizing operators corresponding to error correction codes 
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are measured locally on several copies of the stabilizer states to be purified. A link 
between the state to be purified and the code that can be used for purification is given. 
In particular, it is found that CSS states can be purified by CSS codes, while general 
stabilizer states can be purified by CSS-H codes. 

7. 6. Breeding protocol for all graphs states 

It is straightforward to construct a breeding protocol for all graph states using the 
ingredients presented in the previous section. This is also done in Ref. [90]. Several 
perfect copies of graph states corresponding to a graph gj are used to learn information 
about indices corresponding to qubits Vj by means of a parity check, i.e. operating 
with CNOT gates on a (random) subset of copies with the perfect copy as a target. 
This is done for all groups Vj independently, until complete knowledge about the 
ensemble of states at hand is obtained and hence N copies of the pure graph state 
corresponding to graph G are produced. Using the procedure described previously, 
graph states corresponding to graphs gj are generated and given back at the end 
(they where quasi borrowed to perform the breeding protocol). Two copies of the 
graph state |<I'o)g £^re required to generate a single copy of I'l'o)^^- Notice that also 
here an improved (adaptive) protocol is conceivable, which would lead to a higher 
yield. In addition, the generation of n copies of \^o)gj from m copies of |$o)g might 
be possible with a rate n/m larger than 1/2, which would also increase the yield of 
the protocol. 

A breeding protocol for all stabilizer states (inspired by the approach of Ref. 
[103] ) with improved yield has recently been put forward in Ref. |104j . 

7. 7. Entanglement purification of non- stabilizer states 

While all bipartite and multipartite entanglement purification protocols we have 
described so far purify stabilizer states, i.e. state which are eigenstates of local 
stabilizer operators, a multipartite entanglement purification protocol was recently 
obtained [105] that allows one to purify a non-stabilizer state, in particular a T4^-state 

l^^> = J(|001) + |010) + |100)). (45) 

This protocol is a 3 — > 1 protocol and stabilizing operators corresponding to an 
orthonormal basis including the W state are measured locally. Among other interesting 
features such as mutually unbiased bases, it has not only the 3-particle W state but 
also maximally entangled states shared between two of the parties as attracting fixed 
points |105j . 

Furthermore, in Ref. [107j . a protocol for topological quantum distillation has 
been put forward. There, a new class of topological quantum error correction codes has 
been introduced, and it was shown how to perform arbitrary Clifford operations [T^] 
on encoded systems. As Clifford operations are the main ingredient of the purification 
protocols known so far, this provides a way of obtaining distillation protocols for 
topologically encoded systems. 

7.8. Multipartite recurrence protocols with noisy apparatus 

Similar as for bipartite entanglement purification protocols, one can performed an 
analysis for multipartite entanglement purification protocols [89] with noisy apparatus. 
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In this case, an intriguing question is the scalabihty of the process, i.e. whether e.g. 
the threshold for purification depends on the number of parties N. Numerical results 
for the purification range (minimal required and maximal reachable fidelity) as well 
as error threshold for linear cluster states of different size are given in Fig. 1131 Again, 
errors of the order of several percent are tolerable. 




0.92 0.94 0.96 0.98 1 
Error parameter p 

Figure 13. Maximal reacliable fidelity Fmax and minimal required fidelity -Fmin 
plotted against error parameter p (local operations) for density operators arising 
from single-qubit white noise. Curves from top to bottom (black, blue green, cyan, 
red) correspond to linear cluster states with A'^ = 2, 4, 6, 8, 10 particles. Figure 
taken from Ref. I89| . 

An important observation is that the threshold value Pmin is for linear cluster 
states independent of the number of particles n. That is, also multipartite states 
of large number of particles can be successfully purified, and the requirements on 
local control operations are independent of the system size. This is not true when 
attempting to purify GHZ states [5^, where one finds that the required fidelity of 
local control operations depends on the particle number. 

The qualitative difference of cluster and GHZ states can already be understood 
from an analytically solvable toy model [89], where one considers mixtures of GHZ 
states |<&o,o) and \^i.o) and a restricted error model of only bit flip errors in set 
Vb, that preserve the structure of such states. Using the fact that bit flip errors in 
Vb act like phase flip errors in Va, and the fact that sub-protocol PI is sufficient 
to purify such states, one obtains a lower bound on the threshold value Pmin given 
by Pmin = (5)^^^" ■ This follows from arguments similar as in the derivation of 
purification curve for the bipartite BBPSSW protocol. Performing a similar analysis 
for binary-type mixtures of linear cluster states under this restricted noise model, 
one observes that the threshold value Pmin is largely independent of the number of 
particles n, in agreement with the numerical observations for systems of up to size 
n = 10 under a more general noise model. 
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8. Applications II 

In this section we discuss several applications of multiparty entanglement purification 
protocols. We understand that multipartite entangled states are resources to perform 
different tasks, ranging from multiparty secure applications such as secret sharing 
or Byzantine agreement to measurement-based quantum computation. Hence the 
generation of these entangled states with high fidelity is desirable, and here it is where 
multiparty entanglement purification comes into play. 

8.1. Quantum communication cost for multiparty state distribution 

A scenario of particular interest is given when entangled states need to be distributed 
to spatially separated parties over noisy quantum channels in such a way that they 
are generated with high fidelity. As shown in Ref. |108j . there are several strategies 
conceivable to achieve this task. The two main strategies consist in (see Fig. [T4|) 

(i) the distribution of bipartite entangled pairs through noisy channels that are 
purified by using bipartite entanglement purification protocols; local generation 
of the desired multiparticle entangled state and distribution via teleportation to 
the different parties, using the purified entangled pairs. 

(ii) the distribution of the locally generated multiparticle entangled states to the 
different parties through noisy quantum channels; the states are purified by using 
multiparticle entanglement purification protocols. 

Apart from these two main strategies, a large number of intermediate strategies 
are conceivable, where parts of the multiparticle entangled state are distributed and 
purified, and these parts are connected later on to constitute the desired multiparticle 
entangled state, with possible intermediate or final purification steps. 

A thorough analysis of the different strategies (see [108j ) reveals that, in general, 
the multiparty strategy (ii) performs better if the desired target fidelity is high, 
while the bipartite strategy (i) may be used for lower target fidelities. In particular, 
the fact that multiparticle entanglement purification allows one to achieve higher 
fidelities than strategies based on bipartite purification makes multiparticle protocols 
the only choice if high target fidelities are required. The performance of the different 
strategies is measured by the quantum communication cost, that is, the total number of 
channel usages required to obtain on average a single copy of the desired multiparticle 
entangled state with sufficiently high fidelity. This is illustrated in Fig. [15] for linear 
cluster states and a generic noise model, while Fig. [16] shows results for GHZ state 
and a toy model for noise (see Ref. |108j for details). 

8.2. Secure state distribution 

The secure and secret distribution of an unknown multipartite state with high fidelity 
provides a basic quantum primitive, as multipartite entangled states can serve as 
resource to perform certain quantum information processing tasks. The specific type 
of entanglement determines the (class of) tasks that can be performed. Hence it is easy 
to imagine scenarios where the involved parties do not want any third party to learn 
which secret state they possess, and they wish at the same time their entanglement to 
be private. While in an idealized scenario where one assumes perfect local operations, 
this task can be achieved rather easily, under non-idealized conditions (as one typically 
faces) the problem becomes non-trivial. Multipartite entanglement purification is the 
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(a) BPP strategy 



(b) MPP strategy 
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Figure 14. Distribution of Af-qubit GHZ states over noisy channels, (a) Bipartite 
entanglement purification strategy: Bell pairs are sent over the channels and 
purified using bipartite entanglement purification. The purified pairs are then 
connected to the desired GHZ state, (b) Multipartite entanglement purification 
strategy: Alice prepares the GHZ state locally and sends all but one of the 
particles through the channels. Then, the multiparty entanglement purification 
protocol is used. Figure taken from Ref. |108j . 



main tool to achieve the secure and secret distribution of high-fidehty multipartite 
entanglement. However, standard entanglement purification protocols need to be 
modified to take care of additional secrecy and security requirements. In particular, 
even parties involved in the purification process may not be allowed to learn which 
state they are purifying. 

In Ref. 109J, three different solutions to the secure-state distribution problem 
were put forward (see Fig. [T7| . The first solution is based on bipartite entanglement 
purification, which serves to purify channels. Together with teleportation, this enables 
one to generate arbitrary multipartite entangled states. The second solution makes 
use of direct multipartite entanglement purification protocols, which is combined with 
basis randomization and adapted accordingly to ensure security. Security in the 
third solution, again based on direct multipartite purification, is ensured by purifying 
enlarged states. Each of the solutions offers its own advantages, and there exist in fact 
parameter regimes (for local noise, channel noise, desired target fidelity) such that one 
of the three schemes can be applied, while the other two fail. 

8.3. Quantum error correction using graph states 

Since certain graph states constitute codewords of error correction codes, one may 
use the purification of these graph states to achieve high fidelity encoding without 
making use of complicated encoding networks [SHj. In particular, the 7 qubit CSS 
code can be obtained by using a two-colorable graph state of eight vertices (a cube) 
as resource, and teleportation. Concatenated codes of this kind can be obtained by 
appending to each vertex of the cube another cube (see Fig. [T8| . Encoding into the 
graph state can be achieved by a single Bell measurement [89] , where the qubit to be 
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Figure 15. (Color online.) Inverse of communication cost for different target 
fidelities for 3 (red solid line for multiparty entanglement purification and green 
dashed line for bipartite entanglement purification) and 15 (pink dotted line for 
multiparty entanglement purification and blue small dashed line for bipartite 
entanglement purification) qubit cluster states. The data points are the outputs 
for 1, 2, 3, ...iterations of the protocol. The intermediate points are obtained 
by mixing ensembles of different fidelities. For more than 6 steps, the difference 
between the reached fidelity and the maximum reachable fidelity is smaller than 
the uncertainty. For any number of parties, the curves representing the two 
strategies cross over. The disks give this cross-over for A'^ = 3, 4, 5, 6, 7, 8, 9, 10, 15. 
(That one curve seems to "go back" is just an artifact of the statistical inaccuracies 
of the Monte Carlo method.) Figure taken from Ref. 11081 . 



encoded is coupled by the Bell measurement to the 8^^ vertex of the cube. A similar 
procedure is considered for the five qubit code in Ref. [5^ , where the notion of graph 
codes was introduced (see also [9^). The fidelity of the encoding mainly depends on 
the fidelity of the two-colorable graph state used in the procedure described above. 
Hence, multipartite entanglement purification can be applied to generate high fidelity 
entangled states which are then used to achieve high fidelity encoding. Notice that 
this can also be viewed as the purification of a quantum circuit, namely the encoding 
circuit. 

8.4- Purification of circuits and one-way quantum computation 

In the one-way quantum computer model, a multipartite entangled state, the 2D 
cluster state [92], serves as universal resource for quantum computation [1101 ^T\ . 
That is, given a cluster state of suitable size, an arbitrary quantum algorithm can 
be implemented by a sequence of single-qubit measurements. In a similar way, 
other graph states represent algorithm-specific resources, i.e. they allow one to 
implement a specific algorithm (depending on the graph state) by means of single qubit 
measurements |91j . In the presence of imperfect operations, the cluster- or graph state 
may not be available with unit fidelity. However, entanglement purification may be 
applied to increase the fidelity and hence to reduce errors in quantum computation. 
To what extent the purification of graph states can be used in fault tolerant quantum 
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Figure 16. Inverse of communication cost as function of final fidelity for a 
simplified noise model. Analytical calculation for GHZ states of different number 
of qubits N varying from 5 to 70, with alteration probability for the channel and 
local noise of (1 — g) = 0.1 and (1 — qi) = 0.05 respectively. The green dashed 
lines stand for multiparty entanglement purification strategy while the red solid 
lines stand for bipartite entanglement purification strategy. The blue circles give 
the crossing points for all number of parties between 5 and 70. Figure taken from 
Ref. [TOHI . 




computation is subject of current research. An interesting approach in this direction 
is the usage of encoded 2D cluster states [111) . The encoding serves to perform error 
correction and to aUow for a fault-tolerant implementation of measurement based 
quantum computation. Also such encoded resource states may be purified using known 
entanglement purification protocols. Fault-tolerant one-way quantum computation 
with highly verified logical cluster states has recently been discussed in Ref. [112| . 

We remark that other resource states have been identified recently to constitute a 
universal resource for measurement -based quantum computation [113]. In particular, 
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Figure 18. Graph corresponding to a concatenated 7-qubit CSS code with input 
(red), auxiUary (blue) and output (black) vertices. Figure taken from Ref. [96) . 



graph states corresponding to Triagonal-, Kogome- or Hexagonal lattices are also 
universal. The latter is of particular importance, as the corresponding states are less 
sensitive to local noise in the sense that their lifetime of entanglement is longer [114j , 
and the multiparticle entanglement purification protocols that allow one to purify these 
states have less stringent error thresholds for local noise. This can be understood from 
the fact that the local degree of the graph determines (or at least strongly influences) 
the thresholds, as local noise only affects a given qubit and its neighbors in the graph. 
The degree of the hexagonal lattice is three, the minimal possible to obtain a universal 
resource for translationally symmetric lattice-type graphs [llSj . Notice that the 2D 
cluster state has degree four. 

8.5. Ancilla factory approach to fault-tolerant quantum computation 

Also in the network model for quantum computation, entanglement purification can 
be useful as already demonstrated in Sec. 16.31 Here we discuss a second possible 
application, making use of multiparty entanglement purification. In fault-tolerant 
quantum computation, quantum information is processed in an encoded form in a 
fault-tolerant way. The encoding into a higher-dimensional Hilbert space allows 
for the detection and correction of errors. To perform the error correction in a 
fault -tolerant way, one possible approach (see e.g. Refs. [1151 11161 11171 I118j ) is 
to generate encoded ancilla particles in a predefined state |0l), and use them for error 
syndrome extraction. In addition, logical single and two qubit gates can be performed 
in via gate-teleportation [79l [80l [H] [82l ESI [84j, i.e. by generating certain encoded 
entangled states which are used to implement gates on the logical qubits. When using 
(concatenated) CSS codes, the logical state \0l) actually corresponds to a certain 
stabilizer (or graph) state, a highly entangled multiparticle state. Also the logical 
entangled states required for the teleportation-based gates are (highly entangled) 
multiparticle stabilizer states. The high-fidelity generation of these states is essential 
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in the scheme, and in this context multiparticle entanglement purification, together 
with the usage of error detection schemes plays an important role. 

Recently Knill [115] has presented such an "ancilla factory approach" making use 
of ideas of resource state purification to estimate error thresholds for fault-tolerant 
quantum computation. The estimates he finds are of the order of 10~^, i.e. tolerable 
errors in operation are of order of one percent. This gives essentially the same order 
of magnitude as for multiparticle entanglement purification protocols. However, the 
approach still has a formidable overhead in resources, in particular for the high fidelity 
preparation of the encoded ancilla particles where billions of copies are required. 

9. Summary and outlook 

In this article, we have briefly reviewed quantum error correction and illustrated 
the basic concepts of entanglement purification. We discussed the close relation 
between these two approaches in the context of quantum communication. We 
then concentrated on entanglement purification and illustrated the basic idea behind 
bipartite and multipartite entanglement purification protocols. We discussed several 
bipartite and multipartite entanglement purification protocols and their applications in 
quantum error correction, long distance quantum communication, multipartite secure 
applications, quantum error correction, gate purification and (fault tolerant) quantum 
computation. The remarkable robustness of entanglement purification protocols under 
the influence of errors in local control operations is central in this context, and 
establishes entanglement purification as a fundamental tool in quantum information 
procession. In particular, we have illustrated that entanglement purification is not 
only restricted to applications in bipartite quantum communication for which it was 
initially introduced, but can also be used for many other purposes. It is remarkable 
that entanglement purification remains a hot topic in the field of quantum information 
processing, and significant progress has been achieved in the last few years. 

Despite of this progress, a number of open problems remain. For instance, we 
do not yet clearly understand the potential power and limitations of entanglement 
purification. The influence of noise and hence the corresponding error thresholds seem 
to be more relaxed than for general fault tolerant quantum computation. This appears 
to be related to the fact that two-way classical communication -as can be used in 
entanglement purification- is provable stronger than one-way classical communication, 
and that one is attempting to protect known information (in the form of a maximally 
entangled state) rather than unknown information (as in the case of quantum error 
correction). Despite of this, as we have indicated in this article, indirect methods 
to use entanglement purification in the context of error correction or fault-tolerant 
quantum computation exist. These applications look very promising, but a more 
detailed analysis including a comparison of the resulting error thresholds needs to be 
performed. 

Other important open problems include the fundamental issue of what types 
of states can actually be purified by some genuinely multipartite entanglement 
purification protocol. Until recently, it appeared that this class is given by the set 
of stabilizer states. However, the discovery of a purification protocol for three qubit 
W-states shows that entanglement purification is not limited to stabilizer states, 
so the quest to identify and characterize the family of states where entanglement 
purification is possible remains open. In this context, it would e.g. be interesting 
to see whether protocols to purify W-states of more than 3 qubits can be found, 
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whether these protocols can be generahzed to purify all Dicke (or symmetric) states, 
or to discover new protocols for other kinds of maximally — or perhaps even non- 
maximally- multipartite entangled states. 

Another important, unresolved issue is the purification range of entanglement 
purification protocols, i.e. the identification of the set of mixed states that can be 
purified by a given entanglement purification protocol. In most cases only sufficient 
conditions for purification can be obtained via numerical Simulations, however an 
analytic treatment, in particular identifying necessary and sufficient purification 
conditions for a given protocol would be desirable. 

The construction of provable optimal entanglement purification protocols is 
another important challenge. Optimality can thereby be understood either with 
respect to the yield of the protocol, or with respect to the purification range. Despite 
considerable effort, such optimal entanglement purification protocols (with either 
optimality requirement) are known only for a few specific situations so far. 

Of particular importance in this context -but also extremely challenging- is the 
extension of such investigations to the case of noisy local control operations. Given 
the possible practical applications of entanglement purification, most notable in the 
context of quantum repeaters for long distance quantum communication, but also for 
fault -tolerant quantum computation or quantum simulation |119j , such optimizations 
are crucial to minimize the required physical resources and to simplify a practical 
realization. More generally, finding new applications of entanglement purification in 
the broad context of quantum information theory and beyond remains an interesting 
and challenging task for future investigations. 
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